org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (>=4.4.2, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-blob-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.0.0, =4.4.2, =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.4.2, =4.0.0, =4.1.0, =4.7.0, =4.8.1, =3.2.0, =3.2.0, =3.27.5 - org.apache.camel.quarkus:camel-quarku...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (>=4.4.2, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-blob-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.0.0, =4.4.2, =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.4.2, =4.0.0, =4.1.0, =4.7.0, =4.8.1, =3.2.0, =3.2.0, =3.27.5 - org.apache.camel.quarkus:camel-quarku...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-blob-changefeed-source-kafka-connector (4.18.0) +13 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.33.2 - org.apache.cam...

org.apache.camel.quarkus:camel-quarkus-azure-eventhubs (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-eventhubs-deployment (>=3.35.0, <=3.38.0) +4 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66906 Source advisory: OSV:GHSA-2X37-89HJ-2J95...

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-60093

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-blob-changefeed-source-kafka-connector (4.18.0) +13 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.15.0, =4.18.1, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.29.0, =3.33.2 - org.apache.cam...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

EUVD-2026-64956

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

org.apache.camel.kafkaconnector:camel-azure-storage-blob-append-sink-kafka-connector (>=4.4.2, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-blob-cdc-source-kafka-connector (>=4.0.0, <=4.4.3) +17 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.0.0, =4.4.2, =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.4.2, =4.0.0, =4.1.0, =4.7.0, =4.8.1, =3.2.0, =3.2.0, =3.27.5 - org.apache.camel.quarkus:camel-quarku...

CVE-2026-66906

The camel-azure-storage-blob component in Apache Camel is vulnerable to a relative path traversal (CWE-22) because the downloadBlobToFile operation fails to perform lexical normalization or boundary checks on remote blob names. When downloading blobs to the directory specified by the fileDir opti...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

org.apache.camel.quarkus:camel-quarkus-azure-eventhubs (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-eventhubs-deployment (>=3.35.0, <=3.38.0) +4 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-blob (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-blob MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66906 Source advisory: MEND:CVE-2026-66906...