Path Traversal Vulnerability in Apache Camel FTP Component
CVE-2026-79983

7.4HIGH

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-79983?

The Apache Camel FTP component contains a path traversal vulnerability that allows an attacker to manipulate the remote file paths accessed by Camel. This vulnerability arises due to improper validation of file paths when polling directories on remote servers. When configured, the component constructs absolute paths for files by concatenating directory settings with server-supplied file names without proper normalization or containment checks. As a result, an adversary could craft directory listings that lead to file operations outside the intended secure directories, enabling potential retrieval, deletion, or renaming of unauthorized files using the application's own credentials. It is crucial for users to update to versions 4.23.0 or later, as earlier versions are susceptible to this vulnerability.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-79983
Created by oscerd