{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-79986/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-79986"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["camel-azure-files (\u003e= 4.0.0 \u003c 4.18.5, \u003e= 4.19.0 \u003c 4.22.1)"],"_cs_severities":["high"],"_cs_tags":["camel-azure-files","path-traversal","cve-2026-79986","apache"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eCVE-2026-79986 identifies a path traversal vulnerability in the \u003ccode\u003ecamel-azure-files\u003c/code\u003e component of Apache Camel. The vulnerability arises because the consumer builds remote paths by concatenating a configured directory with file names reported in an Azure File share listing without verifying if the result stays within the intended directory. While the Azure Files REST service does not typically return path segments that include traversal sequences, the exposure enables unauthorized file operations if the storage backend is untrusted or compromised.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to perform file retrieval, deletion, or renaming of files outside the designated polled directory using the credentials assigned to the endpoint.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade affected Camel installations to the fixed versions: 4.18.5, 4.22.1, or 4.23.0.\u003c/li\u003e\n\u003cli\u003eFor environments where immediate upgrading is not possible, constrain the \u003ccode\u003ecamel-azure-files\u003c/code\u003e consumer using \u003ccode\u003efilter\u003c/code\u003e, \u003ccode\u003eantInclude\u003c/code\u003e, or \u003ccode\u003einclude\u003c/code\u003e to restrict file processing to single-segment names.\u003c/li\u003e\n\u003cli\u003eDisable high-risk consumer options including \u003ccode\u003edelete\u003c/code\u003e, \u003ccode\u003emove\u003c/code\u003e, \u003ccode\u003epreMove\u003c/code\u003e, \u003ccode\u003emoveFailed\u003c/code\u003e, and \u003ccode\u003ereadLock=rename\u003c/code\u003e when interacting with Azure File shares that are not fully trusted.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T16:52:14Z","date_published":"2026-10-30T16:52:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-camel-azure-files-path-traversal/","summary":"The camel-azure-files component in Apache Camel is vulnerable to path traversal (CVE-2026-79986) due to insufficient validation of filenames returned during Azure File share listing, allowing unauthorized file access, deletion, or renaming.","title":"Apache Camel: Path traversal in camel-azure-files (CVE-2026-79986)","url":"https://feed.craftedsignal.io/briefs/2026-10-camel-azure-files-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-79986","version":"https://jsonfeed.org/version/1.1"}