Cve-2026-79986 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-79986/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 16:52:14 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Camel: Path traversal in camel-azure-files (CVE-2026-79986)https://feed.craftedsignal.io/briefs/2026-10-camel-azure-files-path-traversal/Fri, 30 Oct 2026 16:52:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-camel-azure-files-path-traversal/The camel-azure-files component in Apache Camel is vulnerable to path traversal (CVE-2026-79986) due to insufficient validation of filenames returned during Azure File share listing, allowing unauthorized file access, deletion, or renaming.CVE-2026-79986 identifies a path traversal vulnerability in the camel-azure-files component of Apache Camel. The vulnerability arises because the consumer builds remote paths by concatenating a configured directory with file names reported in an Azure File share listing without verifying if the result stays within the intended directory. While the Azure Files REST service does not typically return path segments that include traversal sequences, the exposure enables unauthorized file operations if the storage backend is untrusted or compromised.

Impact

Successful exploitation allows an attacker to perform file retrieval, deletion, or renaming of files outside the designated polled directory using the credentials assigned to the endpoint.

Recommendation

  • Upgrade affected Camel installations to the fixed versions: 4.18.5, 4.22.1, or 4.23.0.
  • For environments where immediate upgrading is not possible, constrain the camel-azure-files consumer using filter, antInclude, or include to restrict file processing to single-segment names.
  • Disable high-risk consumer options including delete, move, preMove, moveFailed, and readLock=rename when interacting with Azure File shares that are not fully trusted.
]]>highadvisorycamel-azure-filespath-traversalcve-2026-79986apache