Medium, CVSS 5.5MavenAmendedPublished
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
CVE-2026-60093 · GHSA-7jwc-q3fj-c9pq
- Affected
- Maven org.apache.camel:camel-azure-storage-datalake >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0
- Fixed in
- 4.22.04.14.94.18.4· Vendor fix available
- Issue
- Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operation, writing into the directory named by the fileDir endpoint option. DataLakeFileOperations.downloadToFile built the local target by joining fileDir with the remote path name exactly as the Azure SDK reported it (new File(fileDir, fileClientWrapper.getFileName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The remote name is not route-controlled data: the consumer enumerates the filesystem in DataLakeConsumer.createBatchExchangesFromPath, which lists paths and creates one exchange per entry from PathItem.getName() verbatim, applying…
Recommended action: Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.