Critical, CVSS 9.1MavenAmendedPublished
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
CVE-2026-66906 · GHSA-2x37-89hj-2j95
- Affected
- Maven org.apache.camel:camel-azure-storage-blob >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0
- Fixed in
- 4.22.04.14.94.18.4· Vendor fix available
- Issue
- Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from…
Recommended action: Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.