Path Traversal

Apache Camel Azure-Storage Datalake component is vulnerable to Path Traversal. The vulnerability is due to DataLakeFileOperations.downloadToFile joining the configured fileDir with an unvalidated remote path name, allowing an attacker to influence Data Lake file names and cause files to be create...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

OPENSUSE-SU-2026:11604-1 azure-storage-azcopy-10.32.7-1.1 on GA media

These are all security issues fixed in the azure-storage-azcopy-10.32.7-1.1 package on the GA media of openSUSE Tumbleweed...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-blob-changefeed-source-kafka-connector (4.18.0) +13 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.33.2 - org.apache.cam...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (>=4.4.2, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-blob-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.0.0, =4.4.2, =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.4.2, =4.0.0, =4.1.0, =4.7.0, =4.8.1, =3.2.0, =3.2.0, =3.27.5 - org.apache.camel.quarkus:camel-quarku...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350761...

org.apache.camel.quarkus:camel-quarkus-azure-eventhubs (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-eventhubs-deployment (>=3.35.0, <=3.38.0) +4 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350763...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350761...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350761...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadToFile operation, which constructs the local file path by directly joining the configured fileDir with the remote path name without validating or normalizing the resulting path. An attacker can...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-blob-changefeed-source-kafka-connector (4.18.0) +13 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.33.2 - org.apache.cam...

GHSA-7JWC-Q3FJ-C9PQ Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

org.apache.camel.quarkus:camel-quarkus-azure-eventhubs (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-eventhubs-deployment (>=3.35.0, <=3.38.0) +4 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66906 Source advisory: GHSA-2X37-89HJ-2J95...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...