Camel-Fop (< 4.18.5, >= 4.19.0 < 4.22.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/camel-fop--4.18.5--4.19.0--4.22.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 11:19:20 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Camel: camel-fop XML External Entity (XXE) injection (CVE-2026-91858)https://feed.craftedsignal.io/briefs/2026-10-camel-fop-xxe/Wed, 21 Oct 2026 11:19:20 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-camel-fop-xxe/The camel-fop component in Apache Camel is vulnerable to XXE injection when a third-party JAXP TransformerFactory is present, enabling local file disclosure and SSRF via maliciously crafted XSL-FO documents.Apache Camel's camel-fop component is affected by an XML External Entity (XXE) vulnerability (CVE-2026-91858) when a non-JDK TransformerFactory (e.g., Saxon-HE) is present on the application classpath. While FopProducer historically relied on FEATURE_SECURE_PROCESSING, this setting is insufficient to restrict external DTD and stylesheet access when using third-party JAXP providers. An attacker can supply a malicious XSL-FO document containing an external entity reference to perform Server-Side Request Forgery (SSRF) or read local files accessible to the application process.

Impact

Successful exploitation allows for reading local files readable by the Camel process and conducting SSRF attacks against internal network resources.

Recommendation

  • Upgrade camel-fop to version 4.18.5, 4.22.1, or 4.23.0.
  • Users of Camel Quarkus should update to version 3.40.0 or later to ensure the inclusion of the patched camel-fop version.
  • If immediate patching is not possible, remove third-party TransformerFactory implementations (such as Saxon-HE) from the classpath to force the application to use the default JDK transformer, which safely handles secure processing.
  • Ensure that untrusted XSL-FO input is not passed directly to a fop: producer endpoint.
]]>mediumadvisoryxxevulnerabilityjava