Skip to content
Threat Feed
Subscribe
high advisory

Apache Camel: Path traversal in camel-azure-files (CVE-2026-79986)

The camel-azure-files component in Apache Camel is vulnerable to path traversal (CVE-2026-79986) due to insufficient validation of filenames returned during Azure File share listing, allowing unauthorized file access, deletion, or renaming.

CVE search metadata

CVE search record: CVE-2026-79986. Severity: high. CVSS: 7.4. EPSS: 0.65%. KEV: no. Product: camel-azure-files (>= 4.0.0 < 4.18.5, >= 4.19.0 < 4.22.1). Brief: Apache Camel: Path traversal in camel-azure-files (CVE-2026-79986). Brief link: https://feed.craftedsignal.io/briefs/2026-10-camel-azure-files-path-traversal/

Triage facts

Revision 1
Applicability
camel-azure-files (>= 4.0.0 < 4.18.5, >= 4.19.0 < 4.22.1)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
3 public sources
Freshness
Revision 1Oct 30, 16:52 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

CVE-2026-79986 identifies a path traversal vulnerability in the camel-azure-files component of Apache Camel. The vulnerability arises because the consumer builds remote paths by concatenating a configured directory with file names reported in an Azure File share listing without verifying if the result stays within the intended directory. While the Azure Files REST service does not typically return path segments that include traversal sequences, the exposure enables unauthorized file operations if the storage backend is untrusted or compromised.

Impact

Successful exploitation allows an attacker to perform file retrieval, deletion, or renaming of files outside the designated polled directory using the credentials assigned to the endpoint.

Recommendation

  • Upgrade affected Camel installations to the fixed versions: 4.18.5, 4.22.1, or 4.23.0.
  • For environments where immediate upgrading is not possible, constrain the camel-azure-files consumer using filter, antInclude, or include to restrict file processing to single-segment names.
  • Disable high-risk consumer options including delete, move, preMove, moveFailed, and readLock=rename when interacting with Azure File shares that are not fully trusted.

Immediate actions

Upgrade camel-azure-files to 4.18.5, 4.22.1, or 4.23.0

IT Operations 72h

Threat Hunt

Monitor application logs for unexpected file access patterns or error messages indicating traversal attempts (e.g., path resolution issues) within Camel Azure File consumers.

T1190 medium medium confidence hunt now

Data: Application logs (Camel consumer activity)

Mitigations

Constrain consumer with filter/antInclude/include and disable delete/move operations

immediate IT Operations

CVE-2026-79986