CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile 路径遍历 用于同一 Apache Camel 漏洞的可运行概念验证（PoC）复现程序，每种运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-blob 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus...

CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile 路径遍历 针对同一 Apache Camel 漏洞的可运行概念验证复现程序，每个运行时一个： 运行时| 目录| 技术栈 ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-datalake 4.18.2 Camel Quarkus| camel-quarkus/| Quarkus 3.36.0 + Camel Quarkus...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-60093

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

EUVD-2026-64956

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

CVE-2026-66906 is a relative path traversal (CWE-22) in the camel-azure-storage-blob component of Apache Camel, rated CVSS 9.1 (Critical) . The downloadBlobToFile operation joins the fileDir endpoint option with the remote blob name verbatim—without lexical normalization or a containment check—so...

CVE-2026-60093 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-60093 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-60093

CVE-2026-60093 is a relative path traversal (CWE-22) in the Apache Camel camel-azure-storage-datalake component (versions 4.0.0–4.21.x, fixed in 4.14.9 / 4.18.4 / 4.22.0 ). The downloadToFile operation joined the configured fileDir with the remote file name from Azure Data Lake Gen2 without lexic...

EUVD-2026-64954

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-60093 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

Exploit for CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile...

PT-2026-80916

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x Description A relative path traversal issue exists in the camel-azure-storage-datalake component during the...

PT-2026-80918

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: tekton-chains, buf, amass, dgraph, local-path-provisioner, k3d, crossplane-provider-azure-managedidentity, ferretdb, secrets-store-csi-driver, nsc, nats, kubernetes-event-exporter, temporal-ui-server, fq, zot, dex, vexctl, k3s, nerdctl, bank-vaults, bom, rekor, cosig...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, tekton-chains, crossplane-provider-aws-sns, buildah, timoni, dgraph, crossplane-provider-aws-cloudfront, local-path-provisioner, crossplane-provider-azure-managedidentity, secrets-store-csi-driver, telegraf, mattermost,...

GO-2026-6061 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, nvidia-container-toolkit, crossplane-provider-aws-sns, docker-compose, k3d, secrets-store-csi-driver, temporal-ui-server, prometheus-operator, cluster-autoscaler, opentelemetry-operator, kafka-proxy, nerdctl, rekor, aws-network-policy-agent, gitsign,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-memorydb, podman, tekton-chains, crossplane-provider-aws-sns, buildah, docker-compose, gitea, crossplane-provider-aws-cloudfront, crossplane-provider-azure-managedidentity, telegraf, mattermost, opentofu, chisel, neuvector-sigstore-interface,...

GO-2024-3107 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, nvidia-container-toolkit, buf, crossplane-provider-aws-sns, docker-compose, timoni, local-path-provisioner, k3d, secrets-store-csi-driver, mailpit, temporal-ui-server, prometheus-operator, kafka-proxy, nerdctl, rekor, bom, aws-network-policy-agent,...