XML External Entity injection in Apache Camel - CVE-2026-91858
Published: October 23, 2026
Vulnerability identifier: #VU157318
CSH Severity: Medium
CVSS v4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-91858
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read files accessible to the Camel process and cause it to issue requests to attacker-specified hosts.
The vulnerability exists due to improper restriction of XML external entity resolution in Apache Camel's FopProducer when transforming untrusted XSL-FO message bodies. A remote attacker can submit an XSL-FO document containing a DOCTYPE with an external subset or an external general entity to disclose accessible file contents and trigger requests to hosts specified in the document.
Exploitation requires an alternative JAXP TransformerFactory on the classpath; default deployments using the JDK's built-in transformer are not affected.
Affected software
Apache Camel
How to mitigate CVE-2026-91858
Install security update from vendor's website.
Apache Camel - addressed in versions 4.18.5, 4.22.1, 4.23.0