--- id: "CVE-2026-79986" kind: "vulnerability" aliases: ["CVE-2026-79986"] title: "Apache Camel: remote file consumers can read, delete or rename files outside polled directory" severity: "high" cvss: 7.4 epss: null exploited: false status: "open" category: "package" products: [] ecosystems: [] tags: ["apache-camel", "azure-files", "ftp", "java", "package", "sftp"] not_affected_if: ["camel-4.23.0-or-later", "fixed-4.22.1-or-4.18.5", "no-remote-file-consumers"] published_at: "2026-10-19T11:17:20+00:00" first_seen_at: "2026-10-23T21:57:17+00:00" updated_at: "2026-10-25T03:27:16+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79986", "first_seen_at": "2026-10-23T21:57:17+00:00"}] --- # Apache Camel: remote file consumers can read, delete or rename files outside polled directory Apache Camel's remote-file consumers build remote paths from directory listing names without checking they stay inside the polled directory, so a listing entry containing path traversal makes Camel retrieve, delete or rename files outside that directory using the endpoint's credentials. The azure-files scheme inherits the same flaw, though the sources say Azure Files does not normally return such names. _Summary, check and fix written by a model from the sources; labelled as such._ ## How to check - Check the Camel version in the project's dependency file, for example `mvn dependency:tree | grep camel-azure-files` or `camel-azure-files` in `build.gradle`. - Look for `azure-files:` endpoints in routes and confirm whether `delete=true`, `move`, `preMove`, `moveFailed` or `readLock=rename` is set. ## Fix - Upgrade Apache Camel to `4.23.0`. - Users on the 4.22.x stream upgrade to `4.22.1`. - Users on the 4.18.x LTS stream upgrade to `4.18.5`. - The 4.14.x stream is end of life and gets no fix; move to a supported stream. ## Timeline - 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-79986 ## From the sources Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the azure-files scheme. Its consumer derives from the same RemoteFileConsumer base class and composed the remote path through a plain concatenation helper, so it inherited the same unconstrained resolution. Reaching it requires a listing name that is not a single path segment, which the Azure Files REST service does not normally return; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_