{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camel-fop--4.18.5--4.19.0--4.22.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":6.5,"id":"CVE-2026-91858"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-fop (\u003c 4.18.5, \u003e= 4.19.0 \u003c 4.22.1)","Camel Quarkus (\u003c 3.40.0)"],"_cs_severities":["medium"],"_cs_tags":["xxe","vulnerability","java"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel's \u003ccode\u003ecamel-fop\u003c/code\u003e component is affected by an XML External Entity (XXE) vulnerability (CVE-2026-91858) when a non-JDK \u003ccode\u003eTransformerFactory\u003c/code\u003e (e.g., Saxon-HE) is present on the application classpath. While \u003ccode\u003eFopProducer\u003c/code\u003e historically relied on \u003ccode\u003eFEATURE_SECURE_PROCESSING\u003c/code\u003e, this setting is insufficient to restrict external DTD and stylesheet access when using third-party JAXP providers. An attacker can supply a malicious XSL-FO document containing an external entity reference to perform Server-Side Request Forgery (SSRF) or read local files accessible to the application process.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for reading local files readable by the Camel process and conducting SSRF attacks against internal network resources.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003ecamel-fop\u003c/code\u003e to version 4.18.5, 4.22.1, or 4.23.0.\u003c/li\u003e\n\u003cli\u003eUsers of Camel Quarkus should update to version 3.40.0 or later to ensure the inclusion of the patched \u003ccode\u003ecamel-fop\u003c/code\u003e version.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, remove third-party \u003ccode\u003eTransformerFactory\u003c/code\u003e implementations (such as Saxon-HE) from the classpath to force the application to use the default JDK transformer, which safely handles secure processing.\u003c/li\u003e\n\u003cli\u003eEnsure that untrusted XSL-FO input is not passed directly to a \u003ccode\u003efop:\u003c/code\u003e producer endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T11:19:20Z","date_published":"2026-10-21T11:19:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-fop-xxe/","summary":"The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.","title":"Apache Camel: camel-fop XML External Entity (XXE) injection (CVE-2026-91858)","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-fop-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel-Fop (\u003c 4.18.5, \u003e= 4.19.0 \u003c 4.22.1)","version":"https://jsonfeed.org/version/1.1"}