CVE-2026-79983
published 2026-10-19CVE-2026-79983: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component. This issue affects Apache Camel…
PriorityP354high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
0.53%
43.9th percentile
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was config
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache_software_foundation | apache_camel | >= 4.0.0 < 4.18.5 | 4.18.5 |
| apache_software_foundation | apache_camel | >= 4.19.0 < 4.22.1 | 4.22.1 |
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal
vendor_redhat·2026-10-19·CVSS 7.4
CVE-2026-79983 [HIGH] CWE-22 org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal
org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal
A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or network attacker modifying server responses can supply crafted file paths, causing Camel to retrieve, rename, or delete files outside the intended boundary using the application's credentials. This flaw leads to unauthorized data disclosure and unexpected file modifications on the remote system.
Package: camel-ftp (Red Hat build of Apache Camel 4 for Quarkus 3) - Affected
Package: camel-ftp (Red Hat build of Apache Camel for Spring Boot 4) - Affected
Package: ca
GHSA
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.
ghsa_unreviewed·2026-10-19
CVE-2026-79983 [HIGH] CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel FTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where th
No detection rules found.
No public exploits indexed.
https://camel.apache.org/security/CVE-2026-79983.htmlhttps://github.com/apache/camel/pull/25730https://github.com/apache/camel/pull/25745https://github.com/apache/camel/pull/25746https://github.com/apache/camel/pull/25747https://issues.apache.org/jira/browse/CAMEL-24487https://github.com/oscerd/CVE-2026-79983
2026-10-19
Published