{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-79983/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Camel (4.0.0-4.18.4, 4.19.0-4.22.0)","Camel"],"_cs_severities":["high"],"_cs_tags":["camel-ftp","path-traversal","cve-2026-79983","apache-camel"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel, specifically the \u003ccode\u003ecamel-ftp\u003c/code\u003e component, is vulnerable to a path traversal issue (CVE-2026-79983) that allows an attacker to read, rename, or delete files outside of the defined polled directory. The vulnerability arises because remote-file consumers construct absolute paths by concatenating the configured polling directory with the file name reported in the server directory listing without sufficient validation or lexical normalization.\u003c/p\u003e\n\u003cp\u003eBecause the FTP control channel lacks inherent integrity protection, an attacker performing a man-in-the-middle attack or an attacker controlling a malicious or multi-tenant FTP server can inject crafted file names containing directory traversal sequences such as 'd/../../'. If the service is configured with options like 'delete=true', 'move', 'preMove', or 'readLock=rename', the vulnerable consumer may perform these actions on unauthorized files using the credentials of the Camel service itself. The vulnerability affects Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthorized file access, including reading sensitive system files or deleting/renaming files on the filesystem accessible to the Camel service. In environments where the service account has elevated privileges, this could result in significant data exfiltration or service disruption. The risk is particularly high for implementations using cleartext FTP or those connecting to untrusted or multi-tenant remote FTP servers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Apache Camel to version 4.18.5, 4.22.1, 4.23.0, or later to incorporate the fix for CVE-2026-79983.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not feasible, migrate from insecure FTP to SFTP or FTPS to ensure transport integrity and verify host certificates to prevent MITM-based listing manipulation.\u003c/li\u003e\n\u003cli\u003eImplement strict filters on file consumers using 'antInclude' or 'include' options to restrict processing to expected file name patterns.\u003c/li\u003e\n\u003cli\u003eRestrict the permissions of the FTP service account to only the specific directory intended for polling to minimize the scope of potential traversal.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for files being processed that appear to resolve outside of the intended root directory, which may indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T16:27:02Z","date_published":"2026-10-16T13:33:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-ftp-traversal/","summary":"Apache Camel's camel-ftp component contains a path traversal vulnerability (CVE-2026-79983) allowing unauthorized file operations outside the intended directory via malicious server-supplied file listings.","title":"Apache Camel FTP Component Path Traversal Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-ftp-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-79983","version":"https://jsonfeed.org/version/1.1"}