Skip to content
Threat Feed
Subscribe
medium advisory

Apache Camel: camel-fop XML External Entity (XXE) injection (CVE-2026-91858)

The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.

CVE search metadata

CVE search record: CVE-2026-91858. Severity: medium. CVSS: 6.5. EPSS: 0.36%. KEV: no. Product: camel-fop (< 4.18.5, >= 4.19.0 < 4.22.1), Camel Quarkus (< 3.40.0). Brief: Apache Camel: camel-fop XML External Entity (XXE) injection (CVE-2026-91858). Brief link: https://feed.craftedsignal.io/briefs/2026-10-camel-fop-xxe/

Triage facts

Revision 1
Applicability
camel-fop (< 4.18.5, >= 4.19.0 < 4.22.1), Camel Quarkus (< 3.40.0)
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
4 public sources
Freshness
Revision 1Oct 21, 11:19 UTC
Vulnerabilities
1 CVE
Source quality
A1Likely

Apache Camel's camel-fop component is affected by an XML External Entity (XXE) vulnerability (CVE-2026-91858) when a non-JDK TransformerFactory (e.g., Saxon-HE) is present on the application classpath. While FopProducer historically relied on FEATURE_SECURE_PROCESSING, this setting is insufficient to restrict external DTD and stylesheet access when using third-party JAXP providers. An attacker can supply a malicious XSL-FO document containing an external entity reference to perform Server-Side Request Forgery (SSRF) or read local files accessible to the application process.

Impact

Successful exploitation allows for reading local files readable by the Camel process and conducting SSRF attacks against internal network resources.

Recommendation

  • Upgrade camel-fop to version 4.18.5, 4.22.1, or 4.23.0.
  • Users of Camel Quarkus should update to version 3.40.0 or later to ensure the inclusion of the patched camel-fop version.
  • If immediate patching is not possible, remove third-party TransformerFactory implementations (such as Saxon-HE) from the classpath to force the application to use the default JDK transformer, which safely handles secure processing.
  • Ensure that untrusted XSL-FO input is not passed directly to a fop: producer endpoint.

Immediate actions

Inventory all applications utilizing Apache Camel camel-fop.

IT Operations 48h

Mitigations

Upgrade camel-fop to 4.22.1 or 4.23.0.

immediate IT Operations

CVE-2026-91858