Path traversal in Apache Camel - CVE-2026-60093
Published: August 25, 2026
Vulnerability identifier: #VU145144
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-60093
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to create or overwrite files outside the configured download directory.
The vulnerability exists due to path traversal in DataLakeFileOperations.downloadToFile when processing remotely supplied Azure Data Lake path names during downloadToFile operations. A remote user can influence the names present in the consumed Data Lake filesystem to create or overwrite files outside the configured download directory.
The issue occurs because listed path names are taken verbatim from the remote filesystem and are not normalized or checked to ensure the resolved path remains within fileDir.
Affected software
Apache Camel
How to mitigate CVE-2026-60093
Install security update from vendor's website.
Apache Camel - addressed in versions 4.14.9, 4.18.4, 4.22.0