Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-79984— Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

Quick assessment

Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Camel Mina SFTP 组件中存在“对路径名限制到受限目录不当”（即路径遍历）漏洞。 受影响版本： Apache Camel 从 4.18.0 到 4.18.5 之前的版本，以及从 4.19.0 到 4.22.1 之前的版本。 漏洞详情： Camel 的远程文件消费者会轮询远程服务器上的目录，并通过将配置的目录与服务器目录列表中报告的文件名拼接，构建每个文件的绝对远程路径。该拼接操作（由 和 执行）未进行任何词法规范化，也未验证拼接结果是否仍位于被轮询的目录内。由此生成的路径将作为后续所有远程

CVSS 7.4 · High

Affected Version Matrix 5

VendorProduct Version RangeStatus
Apache Software Foundation Apache Camel 4.18.0< 4.18.5 affected
4.19.0< 4.22.1 affected
4.18.5 unaffected
4.22.1 unaffected
4.23.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-79984

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the mina-sftp scheme, an alternative SFTP implementation whose consumer derives from the same RemoteFileConsumer base class and therefore inherited the same unconstrained resolution. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Camel 4.18.0 ~ 4.18.5 -

II. Public POCs for CVE-2026-79984

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-79984

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-79984 (4)

Vendor Advisories for CVE-2026-79984 (1)

Vendor Pages for CVE-2026-79984 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-19 · 62 CVEs total

CVE-2026-78162 10.0 CRITICAL Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom
CVE-2026-88900 8.8 HIGH Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroup
CVE-2026-83531 8.8 HIGH Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie
CVE-2026-78165 8.8 HIGH Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
CVE-2026-80343 8.2 HIGH Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path
CVE-2026-80344 8.2 HIGH Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro
CVE-2026-80312 8.2 HIGH Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
CVE-2026-78164 8.2 HIGH Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid
CVE-2026-88901 8.2 HIGH Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by d
CVE-2026-85250 7.5 HIGH Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum
CVE-2026-85251 7.5 HIGH Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
CVE-2026-79985 7.4 HIGH Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i
CVE-2026-79986 7.4 HIGH Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re
CVE-2026-79983 7.4 HIGH Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i
CVE-2026-91858 6.5 MEDIUM Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh
CVE-2026-84176 6.5 MEDIUM Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig
CVE-2026-85249 6.5 MEDIUM Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
CVE-2026-85254 6.5 MEDIUM Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name
CVE-2026-85296 6.5 MEDIUM Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
CVE-2026-85314 6.5 MEDIUM Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMult

Showing top 20 of 62 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Apache Camel
Same vendor: Apache Software Foundation
Same weakness: CWE-22

V. Comments for CVE-2026-79984

No comments yet

Leave a comment