CVE-2026-79983 Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

[
  {
    "vendor": "Apache Software Foundation",
    "product": "Apache Camel",
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "packageName": "org.apache.camel:camel-ftp",
    "packageURL": "pkg:maven/org.apache.camel/camel-ftp",
    "versions": [
      {
        "status": "affected",
        "version": "4.0.0",
        "lessThan": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "affected",
        "version": "4.19.0",
        "lessThan": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.18.5",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.22.1",
        "versionType": "maven"
      },
      {
        "status": "unaffected",
        "version": "4.23.0",
        "versionType": "maven"
      }
    ],
    "defaultStatus": "unaffected"
  }
]