Path traversal in Apache Camel - CVE-2026-79985
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to read files outside the configured polling directory and, when deletion or renaming is configured, delete or rename files outside that directory using the endpoint's credentials.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in the Apache Camel SMB consumer when constructing remote file paths from server-supplied directory listing names. A remote attacker can supply a listing entry containing traversal segments to make subsequent file operations access paths outside the configured polling directory without normalization or a containment check.
Exploitation requires a server to emit a listing name that is not a single path segment, which a conforming SMB2 implementation does not do. No proof of concept against the SMB scheme was demonstrated.