Because the FTP control channel lacks inherent integrity protection, an attacker performing a man-in-the-middle attack or an attacker controlling a malicious or multi-tenant FTP server can inject crafted file names containing directory traversal sequences such as 'd/../../'. If the service is configured with options like 'delete=true', 'move', 'preMove', or 'readLock=rename', the vulnerable consumer may perform these actions on unauthorized files using the credentials of the Camel service itself. The vulnerability affects Camel versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0.

Impact

Successful exploitation allows for unauthorized file access, including reading sensitive system files or deleting/renaming files on the filesystem accessible to the Camel service. In environments where the service account has elevated privileges, this could result in significant data exfiltration or service disruption. The risk is particularly high for implementations using cleartext FTP or those connecting to untrusted or multi-tenant remote FTP servers.

Recommendation

• Upgrade Apache Camel to version 4.18.5, 4.22.1, 4.23.0, or later to incorporate the fix for CVE-2026-79983.
• If immediate patching is not feasible, migrate from insecure FTP to SFTP or FTPS to ensure transport integrity and verify host certificates to prevent MITM-based listing manipulation.
• Implement strict filters on file consumers using 'antInclude' or 'include' options to restrict processing to expected file name patterns.
• Restrict the permissions of the FTP service account to only the specific directory intended for polling to minimize the scope of potential traversal.
• Monitor application logs for files being processed that appear to resolve outside of the intended root directory, which may indicate exploitation attempts.