XML External Entity injection in Apache Camel - CVE-2026-88901
Published: October 23, 2026
Vulnerability details
The vulnerability allows a remote attacker to read local files accessible to the Camel process, issue requests to internal network locations, and potentially degrade service availability.
The vulnerability exists due to improper restriction of XML external entity references in the Apache Camel Smooks data format and component when unmarshalling XML message bodies with the default Woodstox SAX reader. A remote attacker can supply an XML body containing an external entity declaration or a DOCTYPE with an external subset to cause the parser to resolve external resources, disclose file contents through the unmarshalled result on InOut routes, or send requests to document-specified hosts.
Configurations that declare an EDI, CSV, JSON, or custom reader do not use the vulnerable XML reader and are not affected.