CVE-2026-66907: Apache Camel Path Traversal Vulnerability

CVE-2026-66907 Overview

CVE-2026-66907 is a relative path traversal vulnerability [CWE-23] in the Apache Camel Google Storage component. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. The consumer builds the local destination by appending the remote object name verbatim, without lexical normalization or containment checks. An attacker who can influence object names in a consumed bucket can force Camel to write files outside the configured directory. Affected releases include Apache Camel 4.0.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x.

Critical Impact
Attackers able to influence object names in a consumed Google Cloud Storage bucket can write or overwrite files at arbitrary filesystem locations with the privileges of the Camel process.

Affected Products

Apache Camel 4.0.0 before 4.14.9
Apache Camel 4.15.0 before 4.18.4
Apache Camel 4.19.0 before 4.22.0

Discovery Timeline

2026-08-24 - CVE-2026-66907 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-66907

Vulnerability Analysis

The camel-google-storage consumer downloads GCS objects to the local filesystem when downloadFileName is configured. When the option value contains no expression token, the consumer builds the local destination by appending the object name to it. Internally, evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates downloadFileName + "/${file:name}".

The ${file:name} token returns the file-name header verbatim, unlike ${file:onlyname}, which applies FileUtil.stripPath to strip directory segments. The resulting string is passed directly to new File(result) and blob.downloadTo(file.toPath()) with no path normalization and no containment check against the configured directory.

Root Cause

The consumer trusts remote object names as safe local path fragments. Google Cloud Storage object names are opaque UTF-8 keys, and forward slashes are only a display convention for pseudo-directories. Keys containing ../ segments survive round-tripping intact. Camel's other download consumers (camel-file, camel-ftp, camel-smb, camel-mina-sftp, camel-azure-files) already enforce a path-segment boundary check; camel-google-storage was the remaining object-store sink missing this control.

Attack Vector

The consumer iterates every returned blob and creates one exchange per object from blob.getBlobId().getName() verbatim. The filter option that could restrict names is not applied unless explicitly set. An attacker who can write objects to the consumed bucket (or influence its contents through an upstream system) can create an object whose name contains parent-directory segments. When Camel consumes that object, it resolves the destination to a location outside downloadFileName, overwriting or creating a file at the attacker's chosen path with the privileges of the Camel process.

No verified public exploit code is available. Refer to the Apache Camel CVE-2026-66907 Advisory for authoritative technical details.

Detection Methods for CVE-2026-66907

Indicators of Compromise

Files written outside the configured downloadFileName directory by the Camel process, particularly in system directories or user home paths.
Google Cloud Storage audit log entries showing object creation with names containing ../ sequences or embedded path separators in unexpected positions.
Unexpected modification of Camel configuration files, cron entries, SSH authorized_keys, or shared library paths on hosts running affected Apache Camel routes.

Detection Strategies

Enumerate deployed Apache Camel installations and match runtime versions against the vulnerable ranges (4.0.0–4.14.8, 4.15.0–4.18.3, 4.19.0–4.21.x).
Inspect Camel route definitions for camel-google-storage consumers that set downloadFileName without an explicit ${file:onlyname} expression or a restrictive filter regex.
Enable and review Google Cloud Storage data access audit logs for object names containing path traversal metacharacters.

Monitoring Recommendations

Alert on filesystem writes by the Camel JVM process outside its designated download directory using host-based file integrity monitoring.
Track outbound GCS object listings and downloads correlated with subsequent writes to sensitive paths.
Review Camel logs for exchanges whose file-name header contains .., /, or backslash characters when consuming from GCS.

How to Mitigate CVE-2026-66907

Immediate Actions Required

Upgrade Apache Camel to version 4.22.0, which contains the containment fix for the camel-google-storage consumer.
Users on the 4.14.x LTS stream should upgrade to 4.14.9; users on the 4.18.x stream should upgrade to 4.18.4.
Audit all camel-google-storage routes and identify any that consume from buckets writable by external principals or upstream applications.
Restrict IAM permissions on consumed buckets so that only trusted producers can create objects.

Patch Information

The Apache Camel project has released fixed versions 4.14.9, 4.18.4, and 4.22.0. The fix adds a path-segment boundary check aligning camel-google-storage with other Camel download consumers. Note that a downloadFileName containing an expression is treated as route-author-controlled and is not covered by the containment check added in the fix. See the Apache Camel Advisory for release details.

Workarounds

Set the filter option to a regular expression that accepts only simple single-segment object names, excluding any name containing a path separator or parent-directory segment before an exchange is created.
Replace the implicit ${file:name} behavior by giving downloadFileName an explicit expression built on ${file:onlyname}, which applies FileUtil.stripPath to remove directory components.
Treat object names in any externally writable bucket as untrusted input and avoid deriving local filesystem paths from them as defense in depth.

bash

# Example Camel route filter workaround (single-segment object names only)
from("google-storage://my-bucket"
    + "?downloadFileName=/var/camel/downloads"
    + "&filter=^[^/\\\\]+$")
  .to("direct:process");