{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/org.apache.camelcamel-aws2-s3-4.19.0-before-4.22.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-95664"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["org.apache.camel:camel-aws2-s3 (4.8.0 before 4.18.5)","org.apache.camel:camel-aws2-s3 (4.19.0 before 4.22.2)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Apache Camel AWS2-S3 component contains an \u0026quot;Improper Neutralization of Special Elements used in an Expression Language Statement\u0026quot; ('Expression Language Injection') vulnerability. The producer evaluates untrusted S3 object keys provided via the CamelAwsS3Key header as Simple expressions.\u003c/p\u003e\n","date_modified":"2026-10-23T14:58:01Z","date_published":"2026-10-23T14:58:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-aws2-s3-injection/","summary":"The Apache Camel AWS2-S3 component is vulnerable to Expression Language Injection. The Camel-AWS2-S3 producer evaluates untrusted S3 object keys from the CamelAwsS3Key header as Simple expressions.","title":"Apache Camel: Expression Language Injection in Camel-AWS2-S3 (CVE-2026-95664)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-aws2-s3-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Org.apache.camel:camel-Aws2-S3 (4.19.0 Before 4.22.2)","version":"https://jsonfeed.org/version/1.1"}