Relative Path Traversal Vulnerability in Apache Camel Azure Storage Blob

CVE-2026-66906

What is CVE-2026-66906?

The Apache Camel Azure Storage Blob component is susceptible to a relative path traversal vulnerability, allowing unauthorized access to the local filesystem. Through its downloadBlobToFile operation, an attacker can exploit the lack of proper path validation, potentially overwriting files outside the intended directory. This occurs because the blob name, containing parent-directory segments, is concatenated with the fileDir option without any checks, enabling manipulation of file locations by influencing blob names. Users are advised to update to the latest versions to mitigate this risk and implement naming constraints for existing deployments, ensuring that only safe file names are processed.

References