CVE-2026-66906: Apache Camel Path Traversal Vulnerability

CVE-2026-66906 Overview

CVE-2026-66906 is a relative path traversal vulnerability [CWE-23] in the Apache Camel Azure Storage Blob component. The camel-azure-storage-blob consumer derives local file paths from remote blob names without normalization or containment checks. An attacker who can influence blob names in a consumed Azure Storage container can force Camel to write files outside the configured fileDir directory. The write occurs with the privileges of the Camel process, enabling arbitrary file creation or overwrite on the host.

Critical Impact
Attackers who control blob names in a consumed container can write arbitrary files outside fileDir, potentially overwriting configuration, binaries, or scheduled tasks with the Camel process privileges.

Affected Products

Apache Camel 4.0.0 through 4.14.8
Apache Camel 4.15.0 through 4.18.3
Apache Camel 4.19.0 through 4.21.x (fixed in 4.22.0)

Discovery Timeline

2026-08-24 - CVE-2026-66906 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-66906

Vulnerability Analysis

The camel-azure-storage-blob component exposes a downloadBlobToFile operation that persists Azure blobs to the local filesystem under the fileDir endpoint option. Internally, BlobOperations.downloadBlobToFile constructs the target path by calling new File(fileDir, client.getBlobName()) and passes the result directly to the Azure SDK. No lexical normalization runs against the blob name, and no post-resolution check verifies that the final path remains within fileDir.

The consumer path amplifies this weakness. BlobConsumer.createBatchExchangesFromContainer enumerates the container and creates one exchange per entry using BlobItem.getName() verbatim, with no default name filtering. Azure Storage containers use a flat namespace where blob names are opaque keys, so names containing .. segments or path separators are stored and listed as given.

Other Camel file-download consumers, including camel-file, camel-ftp, camel-smb, camel-mina-sftp, and camel-azure-files, already enforce a path-segment boundary check. The camel-azure-storage-blob download path was omitted from that hardening work.

Root Cause

The root cause is missing path canonicalization and boundary enforcement when combining an untrusted remote blob name with a local base directory. The fileDir option is classified as a common configuration parameter and carries no security marker, which misleads users into treating it as a containment boundary.

Attack Vector

An attacker with write access to the source Azure container uploads a blob whose name contains parent-directory segments, for example ../../etc/cron.d/payload. When the Camel consumer lists the container and invokes downloadBlobToFile, the resolved path escapes fileDir and writes attacker-controlled content to the traversed location. Impact scales with the privileges of the Camel process and what it is permitted to write.

Detection Methods for CVE-2026-66906

Indicators of Compromise

Files appearing outside the configured fileDir directory with modification timestamps aligned to Camel consumer polling intervals.
Azure Storage blob names containing .., /, or \ sequences within monitored containers.
Unexpected process activity from the Camel JVM writing to system directories such as /etc, /var/spool/cron, or user home directories.

Detection Strategies

Audit Azure Storage container listings for blob names containing path separators or parent-directory tokens.
Instrument the Camel deployment to log the resolved local path produced by downloadBlobToFile and alert on paths that do not begin with the configured fileDir.
Review dependency manifests (pom.xml, build.gradle) for camel-azure-storage-blob versions in the vulnerable ranges.

Monitoring Recommendations

Enable filesystem integrity monitoring on directories writable by the Camel service account.
Forward Camel and JVM logs to a centralized platform and correlate file-write events with blob consumer exchange creation.
Track Azure Storage diagnostic logs for PutBlob operations whose blob names contain traversal patterns.

How to Mitigate CVE-2026-66906

Immediate Actions Required

Upgrade Apache Camel to version 4.22.0, 4.18.4, or 4.14.9 depending on the release stream in use.
Inventory all Camel routes that use camel-azure-storage-blob and identify those invoking downloadBlobToFile.
Restrict write access to Azure Storage containers consumed by Camel to trusted principals only.
Run the Camel process under a least-privilege service account that cannot write to sensitive filesystem locations.

Patch Information

Apache has released fixed versions across all supported streams. Users on 4.19.x or later should upgrade to 4.22.0. Users on the 4.18.x stream should upgrade to 4.18.4, and users on the 4.14.x LTS stream should upgrade to 4.14.9. Refer to the Apache Camel CVE-2026-66906 Advisory for release notes.

Workarounds

Apply the regex endpoint option as a full-string match to accept only simple single-segment blob names, filtering out any name containing a path separator or parent-directory segment.
Use the prefix option to narrow listings server-side; note that when both regex and prefix are set, regex takes priority and prefix is ignored.
Avoid the downloadBlobToFile operation on untrusted containers and instead write payloads to filenames the route itself controls.
Treat blob names from externally writable containers as untrusted input and never derive local filesystem paths from them.

bash

# Example Camel endpoint configuration restricting accepted blob names
from("azure-storage-blob://myaccount/mycontainer"
    + "?fileDir=/var/camel/downloads"
    + "®ex=^[A-Za-z0-9_.-]+$"
    + "&prefix=incoming/")
  .to("direct:process");