CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

Path Traversal

Apache Camel is vulnerable to Path Traversal. The vulnerability is due to the Azure Storage Blob component constructing local file paths directly from attacker-influenced blob names without path normalization or containment checks, which allows an attacker to create or overwrite files outside the...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the downloadBlobToFile path in BlobOperations.java. An attacker can write or overwrite files outside the configured fileDir by supplying a blob name containing ../ segments in a container the route consumes...

Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

GHSA-2X37-89HJ-2J95 Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906 Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

CVE-2026-66906

The camel-azure-storage-blob component in Apache Camel is vulnerable to a relative path traversal (CWE-22) during the downloadBlobToFile operation. The root cause is that the component joins the fileDir endpoint with the remote blob name without lexical normalization or boundary checks, allowing ...

EUVD-2026-64956

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

Exploit for CVE-2026-66906

CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile...

CVE-2026-66906: Relative Path Traversal

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

PT-2026-80918

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.18.24 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7107: Backport to 4.18.z CLONE - ODF Console is breaking DFBUGS-7064: RHODF 4.18.24 release DFBUGS-7046:...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.16.30 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7345: RHODF 4.16.30 release DFBUGS-7105: Backport to 4.16.z CLONE - ODF Console is breaking DFBUGS-6743:...

python311-azure-storage-blob-12.24.1-1.1 on GA media (moderate)

python311-azure-storage-blob-12.24.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14690-1 Rating: moderate Cross-References: CVE-2022-30187 CVSS scores: CVE-2022-30187 SUSE : 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N Affected Products: openSUSE Tumbleweed An update that solves one...

OPENSUSE-SU-2024:12283-1 python310-azure-storage-blob-12.13.1-2.1 on GA media

These are all security issues fixed in the python310-azure-storage-blob-12.13.1-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE-SU-2023:2897-1 Security update for python-azure-core, python-azure-storage-blob

This update for python-azure-core, python-azure-storage-blob fixes the following issues: Security fixes: - CVE-2022-30187: Fixed information disclosure vulnerability bsc1202088. Recommended fixes: - New upstream release version 1.23.1 to SLE 15 bsc1199282, jscPM-3243, jscSLE-24629...

MAL-2022-1378 Malicious code in azure-storage-blob-changefeed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c82d9678e620a731040f4e69c1e04932c1484859155e94875d9e5d5a96fff1e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-storage-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94b5ebb48afe8466af23879ea49942310d63823078c7b8127bbe94867ec42b15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1377 Malicious code in azure-storage-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94b5ebb48afe8466af23879ea49942310d63823078c7b8127bbe94867ec42b15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...