CVE-2026-79985
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component
CVE-2026-79985: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-79985 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 7.4 (Apache), 7.4 (Red Hat)
- Weakness
- CWE-22
- Fixed releases
- Apache: 4.18.5, 4.22.1
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-79985; bulletin-wide values are not repeated here.
Is CVE-2026-79985 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-79985 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-79985?
Upgrade to a fixed release named by the vendor:
- Apache: 4.18.5, 4.22.1
- Upgrade to Apache Camel 4.23.0, which fixes the issue. (Apache)
- Users on the 4.22.x releases stream should upgrade to 4.22.1. (Apache)
Vendor advisory comparison
Apache
1 advisory- Advisory severityHigh7.4
High [CVE-2026-79985] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component
CVE-2026-79985Source published Source updated
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the…
- Affected products in this advisory
- Apache Camel SMB
- Source-reported affected versions
- 4.2.0 before 4.18.5
- 4.19.0 before 4.22.1
- Source-reported fixed versions
- 4.18.5
- 4.22.1
- Mitigation guidance
- Upgrade to Apache Camel 4.23.0, which fixes the issue.
- Users on the 4.22.x releases stream should upgrade to 4.22.1.
- Users on the 4.18.x LTS releases stream should upgrade to 4.18.5.
Red Hat
1 advisory- Advisory severityHigh7.4
High [CVE-2026-79985] Unauthorized file access via path traversal
CVE-2026-79985Source published Source updated
Unauthorized file access via path traversal. Red Hat rates this important (CVSS 7.4). Weakness: CWE-22. Affected products named by the advisory: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4.
- Related products — impact not confirmed
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.