Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-88901— Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default

Quick assessment

Affected
Apache Software Foundation Apache Camel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Camel 存在 XML 外部实体引用（XXE）限制不当的漏洞。 受影响版本范围： Apache Camel 4.7.0 至 4.18.5（不含 4.18.5），以及 4.19.0 至 4.22.1（不含 4.22.1）。 漏洞详情： 该漏洞存在于 Apache Camel 的 Smooks 组件（camel-smooks）中。当攻击者提供包含恶意 XML 消息体时，可通过在 XML 中声明外部实体，读取本地文件，或向内部网络地址发起请求。 在默认配置下，Smooks 数据格式（ ）和 Smooks

CVSS 8.2 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-88901

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser. That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply. A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes. An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour. Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter and the other Camel XML components. This hardening is applied only when the Smooks configuration parses XML with its default reader, so EDI, CSV, JSON and custom-reader configurations, and the marshalling direction, are unchanged. A new allowExternalEntities option, disabled by default, restores the previous behaviour for trusted legacy configurations that rely on external entity resolution. The camel-4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not apply camel-smooks to XML received from untrusted senders.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
XML外部实体引用的不恰当限制(XXE)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Camel 4.7.0 ~ 4.18.5 -

II. Public POCs for CVE-2026-88901

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-88901

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-88901 (2)

Vendor Advisories for CVE-2026-88901 (1)

Other References for CVE-2026-88901 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-19 · 62 CVEs total

CVE-2026-78162 10.0 CRITICAL Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom
CVE-2026-88900 8.8 HIGH Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroup
CVE-2026-83531 8.8 HIGH Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie
CVE-2026-78165 8.8 HIGH Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads
CVE-2026-80343 8.2 HIGH Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path
CVE-2026-80344 8.2 HIGH Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro
CVE-2026-80312 8.2 HIGH Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors
CVE-2026-78164 8.2 HIGH Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid
CVE-2026-85251 7.5 HIGH Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets
CVE-2026-85250 7.5 HIGH Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum
CVE-2026-79985 7.4 HIGH Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i
CVE-2026-79986 7.4 HIGH Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re
CVE-2026-79984 7.4 HIGH Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name repo
CVE-2026-79983 7.4 HIGH Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i
CVE-2026-91858 6.5 MEDIUM Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh
CVE-2026-84176 6.5 MEDIUM Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig
CVE-2026-85249 6.5 MEDIUM Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata
CVE-2026-85314 6.5 MEDIUM Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMult
CVE-2026-85296 6.5 MEDIUM Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State
CVE-2026-85254 6.5 MEDIUM Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name

Showing top 20 of 62 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Apache Camel
Same vendor: Apache Software Foundation
Same weakness: CWE-611

V. Comments for CVE-2026-88901

No comments yet

Leave a comment