GCPBucketBrute

GCPBucketBrute A script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be privilege escalated. This script optionally accepts GCP user/service account credentials and a keyword. Then, a list of permutations will be generated from that keywor...

CVE-2026-66907

CVE-2026-66907 — camel-google-storage downloadFileName path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-google-storage 4.18.2 Camel...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal through the downloadFileName process. An attacker can create or overwrite files outside the intended directory by supplying specially crafted object names containing parent-directory segments in a Google Cloud...

org.apache.camel.kafkaconnector:camel-google-storage-cdc-source-kafka-connector (>=4.0.0, <=4.4.3), org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (>=4.8.0, <=4.14.5) +8 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.0.0, <=4.14.8)

org.apache.camel:camel-google-storage MAVEN version =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-66907 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19318517...

org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-storage-sink-kafka-connector (4.18.0) +6 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.15.0, <=4.18.3)

org.apache.camel:camel-google-storage MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-66907 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19318517...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-19318517...

GHSA-F78G-9385-QXQJ Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-storage-sink-kafka-connector (4.18.0) +6 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.15.0, <=4.18.3)

org.apache.camel:camel-google-storage MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-66907 Source advisory: GHSA-F78G-9385-QXQJ...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: OSV:GHSA-F78G-9385-QXQJ...

org.apache.camel.kafkaconnector:camel-google-storage-cdc-source-kafka-connector (>=4.0.0, <=4.4.3), org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (>=4.8.0, <=4.14.5) +8 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.0.0, <=4.14.8)

org.apache.camel:camel-google-storage MAVEN version =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-66907 Source advisory: OSV:GHSA-F78G-9385-QXQJ...

org.apache.camel.kafkaconnector:camel-google-storage-cdc-source-kafka-connector (>=4.0.0, <=4.4.3), org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (>=4.8.0, <=4.14.5) +8 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.0.0, <=4.14.8)

org.apache.camel:camel-google-storage MAVEN version =4.0.0, =4.0.0, =4.8.0, =4.0.0, =4.0.0, =4.7.0, =3.2.0, =3.2.0, =3.2.0, =4.0.0, =4.14.8 Source cves: CVE-2026-66907 Source advisory: GHSA-F78G-9385-QXQJ...

org.apache.camel.kafkaconnector:camel-google-storage-event-based-source-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-storage-sink-kafka-connector (4.18.0) +6 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.15.0, <=4.18.3)

org.apache.camel:camel-google-storage MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.3 Source cves: CVE-2026-66907 Source advisory: OSV:GHSA-F78G-9385-QXQJ...

org.apache.camel.quarkus:camel-quarkus-google-storage (>=3.35.0, <=3.38.0), org.apache.camel.quarkus:camel-quarkus-google-storage-deployment (>=3.35.0, <=3.38.0) +2 more potentially affected by CVE-2026-66907 via org.apache.camel:camel-google-storage (>=4.19.0, <=4.21.0)

org.apache.camel:camel-google-storage MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.21.0 Source cves: CVE-2026-66907 Source advisory: GHSA-F78G-9385-QXQJ...

CVE-2026-66907

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-66907 Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-66907

Apache Camel's camel-google-storage component is vulnerable to a relative path traversal (CWE-22) when the downloadFileName option is used without expression tokens. The consumer fails to perform lexical normalization or boundary checks, allowing object names containing ../ segments to escape the...

EUVD-2026-64958

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-66907

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

CVE-2026-66907 Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...