High [CVE-2026-66907] Relative path traversal vulnerability in Apache Camel Google Storage component
This high-severity Apache Software Foundation advisory covers CVE-2026-66907 affecting Apache Camel Google.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Relative path traversal vulnerability in Apache Camel Google Storage component.
This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0.
The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the download FileName option is set.
That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates download FileName + "/${file:name}".
The ${file:name} token returns the file-name header verbatim, unlike ${file:onlyname}, which applies FileUtil.stripPath to it. The resulting string was passed directly to new File(result) and blob.download To(file.toPath()) with no lexical normalization and no check that the destination stayed inside the configured directory.
The object name is not route-controlled data: the consumer lists the bucket, iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim, and the filter option that could restrict those names is not applied at all unless it has been explicitly set.
- 4.0.0 before 4.14.9
- 4.15.0 before 4.18.4
- 4.19.0 before 4.22.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 4.14.9
- 4.18.4
- 4.22.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 4.22.0, which fixes the issue.
- If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9.
- If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4.
- For deployments that cannot upgrade immediately, set the filter option to a regular expression that accepts only simple single-segment object names, so that any name carrying a path separator or a parent-directory segment is excluded before an exchange is created; note that no filtering whatsoever is applied when the option is left unset, and that the expression is matched against the whole object name.
- The object name is not route-controlled data: the consumer lists the bucket, iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim, and the filter option that could restrict those names is not applied at all unless it has been explicitly set.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-111422Oct 26, 2026Apache Airflow SSH provider command injection
- CVE-2026-115748Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions
- CVE-2026-115721Oct 26, 2026**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all
- CVE-2026-90885Oct 26, 2026Apache Camel Saxon XXE
- CVE-2026-94386Oct 26, 2026Apache Camel Oauth information disclosure
- CVE-2026-110748Oct 26, 2026This issue affects Apache SIS from version 0.7 through 1.6 inclusive
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.