Path Traversal Vulnerability in Apache Camel Mina SFTP Component
CVE-2026-79984

7.4HIGH

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-79984?

A vulnerability exists in the Apache Camel Mina SFTP component that allows for path traversal due to improper limitation of directory access. This issue arises when the Camel remote-file consumers poll a directory on a remote server and concatenate the configured directory with the reported file names without performing necessary checks. As a result, attackers can exploit this flaw to read, delete, or rename files outside the intended directory, leveraging endpoint credentials. This vulnerability affects Apache Camel versions between 4.18.0 and 4.18.5, as well as 4.19.0 to 4.22.1. Users are advised to upgrade to Apache Camel version 4.23.0 or 4.22.1 to protect against this risk.

Affected Version(s)

Apache Camel 4.18.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-79984
Created by oscerd