CVE-2026-79986 is a path traversal vulnerability in the Apache Camel Azure Files component and other remote-file consumers. It allows an attacker controlling the remote server or on-path to craft directory listing entries that cause Camel to access files outside the configured polling directory. This can lead to unauthorized reading, deletion, or renaming of files on the remote server using the endpoint's credentials. The flaw arises from improper normalization and containment checks on concatenated remote file paths. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5, 4.22.1, and 4.23.0.