Apache Camel: Expression Language Injection in Camel-AWS2-S3 (CVE-2026-95664)
The Apache Camel AWS2-S3 component is vulnerable to Expression Language Injection. The Camel-AWS2-S3 producer evaluates untrusted S3 object keys from the CamelAwsS3Key header as Simple expressions.
CVE search metadata
CVE search record: CVE-2026-95664. KEV: no. Product: org.apache.camel:camel-aws2-s3 (4.8.0 before 4.18.5), org.apache.camel:camel-aws2-s3 (4.19.0 before 4.22.2). Brief: Apache Camel: Expression Language Injection in Camel-AWS2-S3 (CVE-2026-95664). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-camel-aws2-s3-injection/
Triage facts
Revision 1- Applicability
- org.apache.camel:camel-aws2-s3 (4.8.0 before 4.18.5), org.apache.camel:camel-aws2-s3 (4.19.0 before 4.22.2)
- Evidence
- Unknown
- Severity
- Medium
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 14:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- D3Roughly even chance
The Apache Camel AWS2-S3 component contains an "Improper Neutralization of Special Elements used in an Expression Language Statement" ('Expression Language Injection') vulnerability. The producer evaluates untrusted S3 object keys provided via the CamelAwsS3Key header as Simple expressions.