CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.5.13 + camel-azure-storage-blob...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes...

GHSA-2X37-89HJ-2J95 Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

EUVD-2026-64956

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

The camel-azure-storage-blob component in Apache Camel is vulnerable to a relative path traversal (CWE-22) because the downloadBlobToFile operation fails to perform lexical normalization or boundary checks on remote blob names. When downloading blobs to the directory specified by the fileDir opti...

Exploit for CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile...

PT-2026-80918

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.9 Description A relative path traversal issue exists in the camel-azure-storage-blob component. The...

CVE-2026-66906: Relative Path Traversal

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

aztk (>=0.9.0, <=0.10.3), azure-cli (>=2.0.2, <=2.0.67) +8 more potentially affected by CVE-2022-30187 via azure-storage-blob (1.3.1)

azure-storage-blob PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - aztk =0.9.0, =2.0.2, =2.1.7, =0.4.4, =1.4.0, =1.0.0.post1, =2.0.66, =2.2.9, =0.4.9, =0.4.12 Source cves: CVE-2022-30187 Sour...

baybars (>=0.0.1, <=0.0.5), blobxfer (>=1.0.0rc1, <=1.0.0rc3) potentially affected by CVE-2022-30187 via azure-storage-blob (0.37.0)

azure-storage-blob PYPI version 0.37.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - baybars =0.0.1, =1.0.0rc1, =1.0.0rc3 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

blobxfer (1.3.1), kfserving (0.2.1.0) potentially affected by CVE-2022-30187 via azure-storage-blob (1.3.0)

azure-storage-blob PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer 1.3.1 - kfserving 0.2.1.0 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

blobxfer (1.1.1) potentially affected by CVE-2022-30187 via azure-storage-blob (1.0.0)

azure-storage-blob PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - blobxfer 1.1.1 Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...

afs2-datasource (>=3.6.0, <=3.8.2), azblobexplorer (>=1.1.1, <=1.1.4) +4 more potentially affected by CVE-2022-30187 via azure-storage-blob (2.0.1)

azure-storage-blob PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on azure-storage-blob and may be impacted: - afs2-datasource =3.6.0, =1.1.1, =1.8.0, =0.0.1, =0.5.2.1, =0.5.4.3 - xtlib 0.0.996 Source cves: CVE-2022-30187 Source...

altf1be-helpers (2.1.4), amplo (>=0.9.0, <=0.10.1) +127 more potentially affected by CVE-2022-30187 via azure-storage-blob (>=12.0.0b3, <=12.13.0b1)

azure-storage-blob PYPI version =12.0.0b3, =0.9.0, =2020.5.20rc1, =1.0.0b1, =4.0.6, =0.1.0b1, =0.2.5, =1.0.0b1, =0.21.2111.177147b1, =12.0.0b1, =12.0.0b5, =0.2.7, =0.5.0 and more Source cves: CVE-2022-30187 Source advisory: OSV:PYSEC-2026-784...