Unknown [CVE-2026-66906] Relative path traversal vulnerability in Apache Camel Azure Storage Blob component
This security Apache Software Foundation advisory covers CVE-2026-66906 affecting Apache Camel Azure.
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component.
This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.
The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its download BlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer.
BlobOperations.download BlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir.
The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from BlobItem.getName() verbatim, applying no name filtering by default.
A blob name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed container cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process.
- 4.0.0 before 4.14.9
- 4.15.0 before 4.18.4
- 4.19.0 before 4.22.0
Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source
- 4.14.9
- 4.18.4
- 4.22.0
Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 4.22.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4.
- For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created; the prefix option can additionally narrow the listing server-side, noting that when both are set regex takes priority and prefix is ignored.
Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.