{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/camel-quarkus-3.29.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-85250"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-xpath (\u003c 4.18.5, 4.19.0 to 4.22.1)","camel-spring-boot (3.5.13)","camel-quarkus (3.29.0)"],"_cs_severities":["high"],"_cs_tags":["xxe","vulnerability","apache"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel is vulnerable to XML External Entity (XXE) injection (CVE-2026-85250) within the \u003ccode\u003ecamel-xpath\u003c/code\u003e component. The vulnerability exists when an XPath expression is configured with \u003ccode\u003edocumentType=InputSource\u003c/code\u003e. Under this configuration, the \u003ccode\u003eXPathBuilder\u003c/code\u003e passes the XML input directly to \u003ccode\u003ejavax.xml.xpath\u003c/code\u003e, which utilizes default JDK XML parser settings. This process bypasses the security hardening applied to Apache Camel’s default document type, allowing the parser to resolve \u003ccode\u003eDOCTYPE\u003c/code\u003e declarations and expand external entities.\u003c/p\u003e\n\u003cp\u003eIf an application processes untrusted XML using this configuration, an attacker can supply a malicious \u003ccode\u003eDOCTYPE\u003c/code\u003e to exfiltrate sensitive local files accessible by the service account or perform Server-Side Request Forgery (SSRF) against internal resources. Apache has released patches in versions 4.18.5, 4.22.1, and 4.23.0 to force \u003ccode\u003eInputSource\u003c/code\u003e inputs through the same hardened \u003ccode\u003eDocumentBuilderFactory\u003c/code\u003e used by the default document type.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies an application endpoint or service that processes user-supplied XML using Apache Camel's \u003ccode\u003ecamel-xpath\u003c/code\u003e component.\u003c/li\u003e\n\u003cli\u003eThe application is configured to use \u003ccode\u003e.documentType(InputSource.class)\u003c/code\u003e for XPath evaluation on the incoming XML stream.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious XML payload containing a \u003ccode\u003eDOCTYPE\u003c/code\u003e declaration with an external entity pointing to a local file or internal network resource (e.g., \u003ccode\u003e\u0026amp;xxe;\u003c/code\u003e referencing \u003ccode\u003e/etc/passwd\u003c/code\u003e or an internal API endpoint).\u003c/li\u003e\n\u003cli\u003eThe XML payload is sent to the vulnerable service via an HTTP POST request or another XML-consuming interface.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eXPathBuilder\u003c/code\u003e processes the payload using the unhardened JDK default parser configuration.\u003c/li\u003e\n\u003cli\u003eThe XML parser resolves the external entity and retrieves the contents of the local file or makes an outbound HTTP request from the server.\u003c/li\u003e\n\u003cli\u003eThe application returns the results of the XPath evaluation, containing the exfiltrated file contents or the response from the targeted internal resource.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized local file disclosure and potential server-side request forgery. This allows attackers to access sensitive system files, application configuration files, or internal network services that are otherwise protected by the network perimeter. The severity is rated as high due to the potential for full file system access within the context of the application process.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch Apache Camel to version 4.18.5, 4.22.1, or 4.23.0 immediately as documented in the vendor security advisory.\u003c/li\u003e\n\u003cli\u003eFor applications using Apache Camel Spring Boot or Quarkus, update to the versions that incorporate the fixed Camel library versions (e.g., camel-quarkus-xpath fixes released in CQ 3.40.0).\u003c/li\u003e\n\u003cli\u003eAudit codebase for explicit use of \u003ccode\u003e.documentType(InputSource.class)\u003c/code\u003e in \u003ccode\u003eXPathBuilder\u003c/code\u003e and replace with the default document type, which is already hardened against XXE.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation and sanitization for all incoming XML data to prevent malicious \u003ccode\u003eDOCTYPE\u003c/code\u003e declarations.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T15:07:41Z","date_published":"2026-10-19T15:07:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-xpath-xxe/","summary":"An XML External Entity (XXE) vulnerability in the Apache Camel camel-xpath component allows attackers to trigger local file disclosure or server-side request forgery when documentType is set to InputSource.","title":"Apache Camel XML External Entity Injection via camel-xpath","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-xpath-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Camel-Quarkus (3.29.0)","version":"https://jsonfeed.org/version/1.1"}