8 matches found
CVE-2026-79985
CVE-2026-79985 — camel-smb: consumer builds the remote path from the share listing without containment Reproducer repository for the Apache Camel vulnerability where the smb consumer builds the remote path of each polled file by concatenating the configured directory with the name reported in the...
org.apache.camel.quarkus:camel-quarkus-integration-test-smb (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-smb (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-smb (>=4.19.0, <=4.22.0)
org.apache.camel:camel-smb MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-79985 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430832...
org.apache.camel.karaf:camel-smb (>=4.7.0, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-smb (>=3.7.0, <=3.33.3) +3 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-smb (>=4.2.0, <=4.18.4)
org.apache.camel:camel-smb MAVEN version =4.2.0, =4.7.0, =3.7.0, =3.7.0, =3.7.0, =4.2.0, =4.18.4 Source cves: CVE-2026-79985 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21430832...
org.apache.camel.karaf:camel-smb (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-integration-test-smb (>=3.29.0, <=3.33.3) +3 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-smb (>=4.15.0, <=4.18.4)
org.apache.camel:camel-smb MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.4 Source cves: CVE-2026-79985 Source advisory: MEND:CVE-2026-79985...
org.apache.camel.quarkus:camel-quarkus-integration-test-smb (>=3.35.0, <=3.39.0), org.apache.camel.quarkus:camel-quarkus-smb (>=3.35.0, <=3.39.0) +2 more potentially affected by CVE-2026-79985 via org.apache.camel:camel-smb (>=4.19.0, <=4.22.0)
org.apache.camel:camel-smb MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.0 Source cves: CVE-2026-79985 Source advisory: MEND:CVE-2026-79985...
CVE-2026-79985 Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...
CVE-2026-79985
The camel-smb component in Apache Camel is vulnerable to a Path Traversal (CWE-22) flaw because it fails to perform lexical normalization or containment checks when concatenating a configured directory with file names from a remote SMB share listing. This allows a malicious or compromised server ...
