Unknown [CVE-2026-66907] Relative path traversal vulnerability in Apache Camel Google Storage component
This security Apache Software Foundation advisory covers CVE-2026-66907 affecting Apache Camel Google.
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Relative path traversal vulnerability in Apache Camel Google Storage component.
This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.
The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the download FileName option is set.
That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates download FileName + "/${file:name}".
The ${file:name} token returns the file-name header verbatim, unlike ${file:onlyname}, which applies FileUtil.stripPath to it. The resulting string was passed directly to new File(result) and blob.download To(file.toPath()) with no lexical normalization and no check that the destination stayed inside the configured directory.
The object name is not route-controlled data: the consumer lists the bucket, iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim, and the filter option that could restrict those names is not applied at all unless it has been explicitly set.
- 4.0.0 before 4.14.9
- 4.15.0 before 4.18.4
- 4.19.0 before 4.22.0
Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source
- 4.14.9
- 4.18.4
- 4.22.0
Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 4.22.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4.
- For deployments that cannot upgrade immediately, set the filter option to a regular expression that accepts only simple single-segment object names, so that any name carrying a path separator or a parent-directory segment is excluded before an exchange is created; note that no filtering whatsoever is applied when the option is left unset, and that the expression is matched against the whole object name.
- The object name is not route-controlled data: the consumer lists the bucket, iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim, and the filter option that could restrict those names is not applied at all unless it has been explicitly set.
Official advisory · medium-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.