CVE-2026-66907

CVE-2026-66907 — camel-google-storage downloadFileName path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-google-storage 4.18.2 Camel...

org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-storage-sink-kafka-connector (4.18.0) +6 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.15.0, <=4.18.3)

org.apache.camel:camel-google-storage MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-66907 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19318517...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal through the downloadFileName process. An attacker can create or overwrite files outside the intended directory by supplying specially crafted object names containing parent-directory segments in a Google Cloud...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: GHSA-F78G-9385-QXQJ...

GHSA-F78G-9385-QXQJ Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: MEND:CVE-2026-66907...

Exploit for CVE-2026-66907

CVE-2026-66907 — camel-google-storage downloadFileName path...

PT-2026-80919

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 Description A relative path traversal issue exists in the camel-google-storage consumer. When the downloadFileNa...

org.apache.camel.kafkaconnector:camel-google-pubsub-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (>=1.0.0, <=4.14.5) +13 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-google-pubsub (>=3.0.0, <=4.14.5)

org.apache.camel:camel-google-pubsub MAVEN version =3.0.0, =0.1.0, =1.0.0, =1.0.0, =3.19.0, =4.8.0, =0.9.0, =4.7.0, =4.7.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.5.0, =3.0.0, =0.1.9, =0.1.6, =2025.1...