Skip to content
Threat Feed
Subscribe

Product

Camel-Fop (< 4.18.5, >= 4.19.0 < 4.22.1)

1 brief RSS
medium advisory

Apache Camel: camel-fop XML External Entity (XXE) injection (CVE-2026-91858)

The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.

camel-fop +1 xxe vulnerability java
2t 1c