Apache Camel's camel-pqc component versions before 4.18.2 and from 4.19.0 before 4.20.0 contain a deserialization vulnerability in the FileBasedKeyLifecycleManager class. This class deserializes key files without applying object input filtering, allowing an attacker with write access to the key directory to execute arbitrary code. The vulnerability is fixed in versions 4.18.2 and 4.20.0 by replacing the insecure deserialization mechanism with a safer Base64 JSON encoding format for keys.