CVE-2026-60093: Apache Camel Path Traversal Vulnerability

CVE-2026-60093 Overview

CVE-2026-60093 is a relative path traversal vulnerability [CWE-23] in the Apache Camel camel-azure-storage-datalake component. The DataLakeFileOperations.downloadToFile method builds a local target path by joining the configured fileDir with the remote file name reported by the Azure SDK, without lexical normalization or containment checks. An attacker able to influence object names in a consumed Azure Data Lake Storage Gen2 filesystem can supply names containing parent-directory segments, causing Camel to create or overwrite files outside the configured download directory with the privileges of the Camel process.

Critical Impact
Attackers who control Data Lake object names can write arbitrary files outside the configured download directory, potentially overwriting sensitive files and escalating impact beyond loss of file integrity.

Affected Products

Apache Camel 4.0.0 before 4.14.9
Apache Camel 4.15.0 before 4.18.4
Apache Camel 4.19.0 before 4.22.0

Discovery Timeline

2026-08-24 - CVE-2026-60093 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-60093

Vulnerability Analysis

The camel-azure-storage-datalake component provides a consumer that enumerates paths in an Azure Data Lake Storage Gen2 filesystem. The DataLakeConsumer.createBatchExchangesFromPath method lists paths and creates one exchange per entry, taking the name directly from PathItem.getName() with no filtering applied by default.

When the downloadToFile operation runs, DataLakeFileOperations.downloadToFile constructs the local target using new File(fileDir, fileClientWrapper.getFileName()) and passes it directly to the Azure SDK download call. No lexical normalization occurs, and no check verifies that the resolved path stays inside fileDir.

Other Camel file-download consumers, including camel-file, camel-ftp, camel-smb, camel-mina-sftp, and camel-azure-files, already enforce a path-segment boundary check on their local downloads. The camel-azure-storage-datalake component was not covered by that earlier hardening.

Root Cause

The root cause is missing path containment validation. The fileDir endpoint option is documented as a common-group configuration parameter with no security marker, so operators had no indication that its value was not enforced as a containment boundary. Remote object names are treated as trusted input despite originating outside the route.

Attack Vector

An attacker with the ability to create or rename objects in the consumed Data Lake filesystem places entries whose names contain parent-directory segments such as ../../etc/target. When the Camel consumer lists paths and invokes downloadToFile, the resulting File object resolves outside fileDir. The Azure SDK then writes the downloaded content to that arbitrary location using the privileges of the Camel process.

The vulnerability manifests entirely through remote object naming. See the Apache Camel CVE-2026-60093 Advisory for the vendor's technical description of the fix.

Detection Methods for CVE-2026-60093

Indicators of Compromise

Files created or modified by the Camel process outside the configured fileDir directory.
Log entries from the camel-azure-storage-datalake consumer referencing path names containing .. or path separators.
Unexpected changes to configuration files, cron jobs, or application binaries writable by the Camel service account.

Detection Strategies

Audit Camel route configurations for use of the camel-azure-storage-datalake component with the downloadToFile operation and no regex endpoint filter.
Correlate Azure Data Lake object-creation events with local filesystem writes by the Camel process to identify traversal patterns.
Inspect Data Lake listings for objects whose names contain ../, ..\, or embedded path separators.

Monitoring Recommendations

Enable file integrity monitoring on directories adjacent to and above the configured fileDir path.
Capture Camel component debug logging that records resolved local file paths during download operations.
Alert on any write activity by the Camel process account outside of its documented working directories.

How to Mitigate CVE-2026-60093

Immediate Actions Required

Upgrade Apache Camel to 4.22.0, 4.18.4, or 4.14.9 depending on the release stream in use.
Inventory all Camel deployments that use the camel-azure-storage-datalake component and prioritize those consuming externally writable Data Lake filesystems.
Restrict the Camel process account to the minimum filesystem privileges required for its download directory.

Patch Information

Apache has released fixed versions that apply a path-segment boundary check consistent with the other Camel file-download consumers. Upgrade to 4.22.0 on the main stream, 4.18.4 on the 4.18.x stream, or 4.14.9 on the 4.14.x LTS stream. The vendor advisory is available at the Apache Camel CVE-2026-60093 Advisory.

Workarounds

Set the regex endpoint option to a full-string pattern that matches only simple single-segment names, filtering out any name containing a path separator or parent-directory segment before an exchange is created.
Avoid the downloadToFile operation on untrusted filesystems and instead write payloads from the route under file names the route itself controls.
Treat all object names in externally writable Data Lake filesystems as untrusted input and refrain from deriving local filesystem paths from them.

bash

# Example Camel endpoint configuration restricting names to simple single-segment values
from("azure-storage-datalake:account/filesystem"
    + "?fileDir=/var/camel/downloads"
    + "®ex=^[A-Za-z0-9._-]+$"
    + "&operation=downloadToFile")
  .to("log:downloaded");