CVE-2026-60093

A flaw was found in Apache Camel Azure-Storage Datalake. The downloadToFile operation in the camel-azure-storage-datalake component allows a remote attacker to write files to arbitrary locations on the local filesystem. This occurs because the component does not properly validate remote path name...

CVE-2026-60093

CVE-2026-60093 — camel-azure-storage-datalake downloadToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-datalak...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350761...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350761...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-66906 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-66906 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19350761...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadToFile operation, which constructs the local file path by directly joining the configured fileDir with the remote path name without validating or normalizing the resulting path. An attacker can...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19319138...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

GHSA-7JWC-Q3FJ-C9PQ Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-azure-storage-datalake-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.19.0, <=4.21.0)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: GHSA-7JWC-Q3FJ-C9PQ...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: OSV:GHSA-7JWC-Q3FJ-C9PQ...

CVE-2026-60093 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (>=4.0.0, <=4.14.5), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (>=4.0.0, <=4.14.5) +6 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.0.0, <=4.14.8)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.24.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-60093 Source advisory: MEND:CVE-2026-60093...

org.apache.camel.kafkaconnector:camel-azure-storage-datalake-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-azure-storage-datalake-source-kafka-connector (4.18.0) +5 more potentially affected by CVE-2026-60093 via org.apache.camel:camel-azure-storage-datalake (>=4.15.0, <=4.18.3)

org.apache.camel:camel-azure-storage-datalake MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-60093 Source advisory: MEND:CVE-2026-60093...