CVE-2026-60093
Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
Description
Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operation, writing into the directory named by the fileDir endpoint option. DataLakeFileOperations.downloadToFile built the local target by joining fileDir with the remote path name exactly as the Azure SDK reported it (new File(fileDir, fileClientWrapper.getFileName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The remote name is not route-controlled data: the consumer enumerates the filesystem in DataLakeConsumer.createBatchExchangesFromPath, which lists paths and creates one exchange per entry from PathItem.getName() verbatim, applying no name filtering by default. A path name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed Data Lake filesystem cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-datalake download path was not covered by that work. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed path name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created. Alternatively, avoid the downloadToFile operation on untrusted filesystems and write the payload from the route under a file name the route itself controls, rather than one taken from the remote listing. As defence in depth, treat the object names in any externally writable Data Lake filesystem as untrusted input and do not derive local filesystem paths from them.
INFO
Published Date :
Aug. 24, 2026, 5:17 p.m.
Last Modified :
Oct. 12, 2026, 3:10 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Upgrade Apache Camel to version 4.22.0.
- Upgrade to 4.14.9 for 4.14.x.
- Upgrade to 4.18.4 for 4.18.x.
- Filter untrusted names using the regex option.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-60093.
| URL | Resource |
|---|---|
| https://camel.apache.org/security/CVE-2026-60093.html | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/08/24/8 | Mailing List Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-60093 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-60093
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-60093 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-60093 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: Apache Camel de Apache Software Foundation, Description: Vulnerabilidad de salto de ruta relativo en el componente Apache Camel Azure-Storage Datalake Este problema afecta a Apache Camel: desde 4.0.0 antes de 4.14.9, desde 4.15.0 antes de 4.18.4, desde 4.19.0 antes de 4.22.0. El componente camel-azure-storage-datalake puede descargar un archivo de Azure Data Lake Storage Gen2 al sistema de archivos local a través de su operación downloadToFile, escribiendo en el directorio nombrado por la opción de endpoint fileDir. DataLakeFileOperations.downloadToFile construyó el destino local uniendo fileDir con el nombre de ruta remoto exactamente como lo informó el SDK de Azure (new File(fileDir, fileClientWrapper.getFileName())) y pasó el resultado directamente a la llamada de descarga del SDK, sin normalización léxica y sin verificar que la ubicación resuelta permaneciera dentro de fileDir. El nombre remoto no es un dato controlado por la ruta: el consumidor enumera el sistema de archivos en DataLakeConsumer.createBatchExchangesFromPath, que lista rutas y crea un intercambio por entrada de PathItem.getName() textualmente, sin aplicar ningún filtro de nombre por defecto. Un nombre de ruta que contiene segmentos de directorio padre, por lo tanto, se resolvió en una ubicación fuera del fileDir configurado, permitiendo que cualquiera capaz de influir en los nombres presentes en el sistema de archivos de Data Lake consumido haga que Camel cree o sobrescriba un archivo en una ubicación de su elección, con los privilegios del proceso de Camel. Dependiendo de dónde pueda escribir el proceso, sobrescribir un archivo fuera del directorio de descarga puede escalar más allá de la pérdida de integridad de ese archivo. La opción fileDir es un parámetro de configuración común de grupo ordinario y no lleva ningún marcador de seguridad, por lo que nada indicaba a los usuarios que su valor no se estaba aplicando como un límite de contención. Otros consumidores de descarga de archivos de Camel - camel-file, camel-ftp, camel-smb, camel-mina-sftp y camel-azure-files - ya restringían sus descargas locales al directorio configurado utilizando una verificación de límite de segmento de ruta; la ruta de descarga de camel-azure-storage-datalake no estaba cubierta por ese trabajo. Se recomienda a los usuarios actualizar a la versión 4.22.0, que corrige el problema. Si los usuarios están en la rama de versiones LTS 4.14.x, se les sugiere actualizar a 4.14.9. Si los usuarios están en la rama de versiones 4.18.x, se les sugiere actualizar a 4.18.4. Para implementaciones que no pueden actualizarse inmediatamente, restrinja los nombres sobre los que actuará el consumidor utilizando la opción de endpoint regex, que se aplica a cada nombre de ruta listado como una coincidencia de cadena completa, de modo que solo se acepten nombres simples de un solo segmento y cualquier nombre que contenga un separador de ruta o un segmento de directorio padre se filtre antes de que se cree un intercambio. Alternativamente, evite la operación downloadToFile en sistemas de archivos no confiables y escriba la carga útil de la ruta bajo un nombre de archivo que la propia ruta controle, en lugar de uno tomado del listado remoto. Como defensa en profundidad, trate los nombres de objetos en cualquier sistema de archivos de Data Lake escribible externamente como entrada no confiable y no derive rutas de sistema de archivos locales a partir de ellos. -
Initial Analysis by [email protected]
Aug. 27, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* versions from (including) 4.15.0 up to (excluding) 4.18.4 *cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* versions from (including) 4.19.0 up to (excluding) 4.22.0 *cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.14.9 Added Reference Type Apache Software Foundation: https://camel.apache.org/security/CVE-2026-60093.html Types: Mailing List, Vendor Advisory Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/08/24/8 Types: Mailing List, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 25, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Added SSVC {'id': 'CVE-2026-60093', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-25T19:35:53.944827Z'} -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Aug. 24, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/08/24/8 -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Apache Software Foundation', 'product': 'Apache Camel', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '4.14.9', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.15.0', 'lessThan': '4.18.4', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.0', 'lessThan': '4.22.0', 'versionType': 'semver'}], 'packageURL': 'pkg:maven/org.apache.camel/camel-azure-storage-datalake', 'packageName': 'org.apache.camel:camel-azure-storage-datalake', 'collectionURL': 'https://repo.maven.apache.org/maven2', 'defaultStatus': 'unaffected'}] Added Description Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operation, writing into the directory named by the fileDir endpoint option. DataLakeFileOperations.downloadToFile built the local target by joining fileDir with the remote path name exactly as the Azure SDK reported it (new File(fileDir, fileClientWrapper.getFileName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The remote name is not route-controlled data: the consumer enumerates the filesystem in DataLakeConsumer.createBatchExchangesFromPath, which lists paths and creates one exchange per entry from PathItem.getName() verbatim, applying no name filtering by default. A path name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed Data Lake filesystem cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-datalake download path was not covered by that work. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed path name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created. Alternatively, avoid the downloadToFile operation on untrusted filesystems and write the payload from the route under a file name the route itself controls, rather than one taken from the remote listing. As defence in depth, treat the object names in any externally writable Data Lake filesystem as untrusted input and do not derive local filesystem paths from them. Added CWE CWE-23 Added Reference https://camel.apache.org/security/CVE-2026-60093.html