CVE-2026-66906
Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Description
Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from BlobItem.getName() verbatim, applying no name filtering by default. A blob name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed container cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. Azure Storage blob containers use a flat namespace in which the blob name is an opaque key, so a name carrying such segments is stored and listed as given. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-blob download path was not covered by that work. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created; the prefix option can additionally narrow the listing server-side, noting that when both are set regex takes priority and prefix is ignored. Alternatively, avoid the downloadBlobToFile operation on untrusted containers and write the payload from the route under a file name the route itself controls, rather than one taken from the remote listing. As defence in depth, treat the blob names in any externally writable container as untrusted input and do not derive local filesystem paths from them.
INFO
Published Date :
Aug. 24, 2026, 5:18 p.m.
Last Modified :
Oct. 12, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Upgrade to Apache Camel version 4.22.0.
- Upgrade to Apache Camel version 4.14.9 for 4.14.x.
- Upgrade to Apache Camel version 4.18.4 for 4.18.x.
- Filter blob names using regex or prefix endpoint options.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-66906.
| URL | Resource |
|---|---|
| https://camel.apache.org/security/CVE-2026-66906.html | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/08/24/10 | Mailing List Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-66906 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-66906
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-66906 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-66906 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 12, 2026
Action Type Old Value New Value Added Translation Title: Apache Camel de Apache Software Foundation, Description: Vulnerabilidad de salto de ruta relativo en el componente Apache Camel Azure Storage Blob. Este problema afecta a Apache Camel: desde 4.0.0 antes de 4.14.9, desde 4.15.0 antes de 4.18.4, desde 4.19.0 antes de 4.22.0. El componente camel-azure-storage-blob puede descargar un blob de Azure Storage al sistema de archivos local a través de su operación downloadBlobToFile, escribiendo en el directorio nombrado por la opción de endpoint fileDir, que está documentada como utilizable tanto por el productor como por el consumidor. BlobOperations.downloadBlobToFile construyó el destino local uniendo fileDir con el nombre del blob remoto exactamente como lo informó el SDK de Azure (new File(fileDir, client.getBlobName())) y pasó el resultado directamente a la llamada de descarga del SDK, sin normalización léxica y sin verificar que la ubicación resuelta permaneciera dentro de fileDir. El nombre del blob no es un dato controlado por la ruta: el consumidor enumera el contenedor en BlobConsumer.createBatchExchangesFromContainer, que lista blobs y crea un intercambio por entrada de BlobItem.getName() textualmente, sin aplicar filtrado de nombres por defecto. Un nombre de blob que contiene segmentos de directorio padre, por lo tanto, se resolvió a una ubicación fuera del fileDir configurado, permitiendo que cualquiera capaz de influir en los nombres presentes en el contenedor consumido haga que Camel cree o sobrescriba un archivo en una ubicación de su elección, con los privilegios del proceso de Camel. Dependiendo de dónde pueda escribir el proceso, sobrescribir un archivo fuera del directorio de descarga puede escalar más allá de la pérdida de integridad de ese archivo. Los contenedores de blobs de Azure Storage utilizan un espacio de nombres plano en el que el nombre del blob es una clave opaca, por lo que un nombre que contenga dichos segmentos se almacena y se lista tal cual. La opción fileDir es un parámetro de configuración ordinario de grupo común y no lleva ningún marcador de seguridad, por lo que nada indicaba a los usuarios que su valor no se estaba aplicando como un límite de contención. Otros consumidores de descarga de archivos de Camel - camel-file, camel-ftp, camel-smb, camel-mina-sftp y camel-azure-files - ya restringían sus descargas locales al directorio configurado utilizando una verificación de límite de segmento de ruta; la ruta de descarga de camel-azure-storage-blob no estaba cubierta por ese trabajo. Se recomienda a los usuarios actualizar a la versión 4.22.0, que corrige el problema. Si los usuarios están en la rama de versiones LTS 4.14.x, se les sugiere actualizar a 4.14.9. Si los usuarios están en la rama de versiones 4.18.x, se les sugiere actualizar a 4.18.4. Para implementaciones que no pueden actualizarse inmediatamente, restrinja los nombres sobre los que actuará el consumidor utilizando la opción de endpoint regex, que se aplica a cada nombre de blob listado como una coincidencia de cadena completa, de modo que solo se acepten nombres simples de un solo segmento y cualquier nombre que contenga un separador de ruta o un segmento de directorio padre se filtre antes de que se cree un intercambio; la opción prefix puede además reducir la lista en el lado del servidor, teniendo en cuenta que cuando ambos están configurados, regex tiene prioridad y prefix se ignora. Alternativamente, evite la operación downloadBlobToFile en contenedores no confiables y escriba la carga útil de la ruta bajo un nombre de archivo que la propia ruta controle, en lugar de uno tomado de la lista remota. Como defensa en profundidad, trate los nombres de los blobs en cualquier contenedor escribible externamente como entrada no confiable y no derive rutas del sistema de archivos local a partir de ellos. -
Initial Analysis by [email protected]
Aug. 27, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* versions from (including) 4.15.0 up to (excluding) 4.18.4 *cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* versions from (including) 4.19.0 up to (excluding) 4.22.0 *cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:* versions from (including) 4.0.0 up to (excluding) 4.14.9 Added Reference Type Apache Software Foundation: https://camel.apache.org/security/CVE-2026-66906.html Types: Mailing List, Vendor Advisory Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/08/24/10 Types: Mailing List, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 25, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Added SSVC {'id': 'CVE-2026-66906', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-25T19:36:45.646535Z'} -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Aug. 24, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/08/24/10 -
New CVE Received by [email protected]
Aug. 24, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Apache Software Foundation', 'product': 'Apache Camel', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '4.14.9', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.15.0', 'lessThan': '4.18.4', 'versionType': 'semver'}, {'status': 'affected', 'version': '4.19.0', 'lessThan': '4.22.0', 'versionType': 'semver'}], 'packageURL': 'pkg:maven/org.apache.camel/camel-azure-storage-blob', 'packageName': 'org.apache.camel:camel-azure-storage-blob', 'collectionURL': 'https://repo.maven.apache.org/maven2', 'defaultStatus': 'unaffected'}] Added Description Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from BlobItem.getName() verbatim, applying no name filtering by default. A blob name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed container cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. Azure Storage blob containers use a flat namespace in which the blob name is an opaque key, so a name carrying such segments is stored and listed as given. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-blob download path was not covered by that work. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.4. For deployments that cannot upgrade immediately, constrain the names the consumer will act on using the regex endpoint option, which is applied to each listed blob name as a full-string match, so that only simple single-segment names are accepted and any name carrying a path separator or a parent-directory segment is filtered out before an exchange is created; the prefix option can additionally narrow the listing server-side, noting that when both are set regex takes priority and prefix is ignored. Alternatively, avoid the downloadBlobToFile operation on untrusted containers and write the payload from the route under a file name the route itself controls, rather than one taken from the remote listing. As defence in depth, treat the blob names in any externally writable container as untrusted input and do not derive local filesystem paths from them. Added CWE CWE-23 Added Reference https://camel.apache.org/security/CVE-2026-66906.html