CVE-2026-79986

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79983

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel FTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

CVE-2026-79984

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79985

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an arbitrary file write (CVE-2026-17437)

Summary IBM App Connect Enterprise Toolkit is vulnerable to an arbitrary file write. Vulnerability Details CVEID:CVE-2026-17437 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction...

EUVD-2026-104208

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-85300

The Apache Camel PQC component is vulnerable to Incorrect Default Permissions (CWE-276) in versions 4.12.0 to 4.18.5 and 4.19.0 to 4.22.1. The root cause is that the component writes generated key material to disk using default process umask permissions instead of restricting access to the owner....

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-85250

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-85250

Apache Camel is vulnerable to Improper Restriction of XML External Entity Reference (CWE-611) within its XPath component . The flaw occurs when the documentType is set to InputSource, causing the XPathBuilder to use javax.xml.xpath defaults. This bypasses Camel's standard hardening, allowing an a...

CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

EUVD-2026-104191

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

EUVD-2026-104216

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79986

The Apache Camel Azure Files component is vulnerable to a Path Traversal (CWE-22) flaw due to improper path concatenation. The azure-files consumer builds remote paths by joining a configured directory with file names from server listings without lexical normalization or containment checks . Cons...

CVE-2026-79986 Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79986 Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...