CVE-2026-48204 Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

🗓️ 06 Jul 2026 08:06:52Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Apache Camel MongoDB GridFS lets HTTP header bypass to override operations, enabling file deletion.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-48204	6 Jul 202608:06	–	attackerkb
Circl	CVE-2026-48204	5 Jul 202620:14	–	circl
CVE	CVE-2026-48204	6 Jul 202608:06	–	cve
Cvelist	CVE-2026-48204 Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration	6 Jul 202608:06	–	cvelist
EUVD	EUVD-2026-41839	6 Jul 202608:06	–	euvd
NVD	CVE-2026-48204	6 Jul 202609:16	–	nvd
Positive Technologies	PT-2026-55900	6 Jul 202600:00	–	ptsecurity
Snyk	Improperly Controlled Modification of Dynamically-Determined Object Attributes	6 Jul 202610:35	–	snyk
Vulnrichment	CVE-2026-48204 Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration	6 Jul 202608:06	–	vulnrichment

Source	Link
openwall	www.openwall.com/lists/oss-security/2026/07/05/18
repo	www.repo.maven.apache.org/maven2
camel	www.camel.apache.org/security/CVE-2026-48204.html
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48204.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48204

15 Jul 2026 01:49Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.19.8

EPSS0.00452

gridfs operation header web header bypass gridfs deletion header filter bypass nosql injection