High, CVSS 7.5MavenAmendedPublished
Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
CVE-2026-66907 · GHSA-f78g-9385-qxqj
- Affected
- Maven org.apache.camel:camel-google-storage >= 4.0.0, < 4.14.9; >= 4.15.0, < 4.18.4; >= 4.19.0, < 4.22.0
- Fixed in
- 4.22.04.14.94.18.4· Vendor fix available
- Issue
- Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when the downloadFileName option is set. That option is documented as a folder or a filename, and when its value contains no expression token the consumer builds the local destination by appending the object name to it: evaluateFileExpression sets the Exchange file-name header to the remote object name and evaluates downloadFileName + "/${file:name}". The ${file:name} token returns the file-name header verbatim, unlike ${file:onlyname}, which applies FileUtil.stripPath to it. The resulting string was passed directly to new File(result) and blob.downloadTo(file.toPath()) with no lexical normalization and no check that the destination stayed inside the configured directory. The object name is not…
Recommended action: Upgrade to 4.22.0, 4.18.4 or 4.14.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.