CVE-2026-79984
Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
02 Description
Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
03 Exploitation and scoring
- Exploitation
- Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.
- SSVC decision
- ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
- AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.65% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 51.2% of scored records. A rank, not a probability.
- NVD base score
- 7.4 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVD analysis status
- Undergoing Analysis. NVD last modified this record on 2026-10-20.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-19 10:15Z10 DAYS AGO
- Last updated
- 2026-10-20 13:09Z8 DAYS AGO
- Reserved
- 2026-08-25
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.4)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base
- Data version
- 5.2
- Document digest
- 6b08b33ab062797eda46c97f1a42328f71b1b34e92f982e3655a36da6db889ca
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-79984https://camel.apache.org/security/CVE-2026-79984.html
- issues.apache.orgCAMEL-24487https://issues.apache.org/jira/browse/CAMEL-24487
- github.comFix on main, for 4.23.0 (commit 177fb1fdff90632ebfd27772a625b720c1cab3e7)https://github.com/apache/camel/pull/25730
- github.comBackport to camel-4.22.x, for 4.22.1 (commit b31b1754d26352ea823354c8660074aaba257c45)https://github.com/apache/camel/pull/25745
- github.comBackport to camel-4.18.x, for 4.18.5 (commit c1165e4e663c3c3edc7bd30451ecc213fcf68cfd)https://github.com/apache/camel/pull/25746
- github.comUpgrade-guide documentation sync to main (commit a7d7d3ad2e7f940ece35803a0929aa8215d91dfc)https://github.com/apache/camel/pull/25747
- github.comhttps://github.com/oscerd/CVE-2026-79984
07 Remediation
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs on, and a GenericFileConsumer.isWithinStartingDirectory strategy consulted from isValidFile when jailStartingDirectory is enabled. The base implementation is a no-op, because names obtained from a local directory listing are always single path segments; RemoteFileConsumer and SmbConsumer override it to compact the resolved path and verify on path-segment boundaries that it still resolves inside the directory being polled. A file resolving outside is skipped and a warning is logged, rather than raising, so that the remaining legitimate entries in the same listing still process. Containment was chosen over stripping the path component because remote directories are legitimately nested and a parent-directory segment that still resolves back inside the polled directory remains valid. The check runs after the existing match filters so that the "." and ".." entries returned by SFTP servers, which the hidden-file rule already excludes, do not log on every poll. The change adds no new module dependency.