Path traversal in Apache Camel - CVE-2026-79984
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to read, delete or rename files outside the configured remote polling directory using the endpoint's credentials.
The vulnerability exists due to path traversal in the Apache Camel Mina SFTP consumer when resolving remote file paths from server-supplied directory listings without normalization or directory containment checks. A remote attacker can supply a crafted listing entry containing parent-directory traversal segments through a malicious or compromised SFTP server to cause file operations outside the configured polling directory.
Retrieval is reachable with the default consumer configuration; deletion requires delete=true, while renaming requires move, preMove, moveFailed or readLock=rename.