Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Camel - CVE-2026-85249
Published: October 23, 2026
Vulnerability identifier: #VU157302
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-85249
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to manipulate downstream processing and file write destinations through injected Exchange headers, potentially disclosing or modifying data.
The vulnerability exists due to insufficient filtering of document metadata keys in the Apache Camel Tika producer when mapping parsed metadata onto Exchange headers. A remote attacker can submit a crafted document containing metadata keys such as CamelFileName to inject headers that influence downstream components and control where content is written.
Affected software
Apache Camel
How to mitigate CVE-2026-85249
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1