Path Traversal Vulnerability in Apache Camel's Azure Files Component
CVE-2026-79986

7.4HIGH

Key Information:

Vendor: Apache
Status: Apache Camel
Vendor: CVE Published:; 19 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-79986?

A Path Traversal vulnerability in the Azure Files component of Apache Camel allows remote file consumers to build absolute paths without proper validation. This can lead to unauthorized access to files outside the intended directory. The issue arises from insufficient containment checks when processing directory listings from a remote server. Attackers can exploit this flaw by manipulating file names in the server's directory listing to access or modify files beyond the designated polling directory. Users are encouraged to upgrade to Apache Camel 4.23.0 or later to mitigate this risk.

Affected Version(s)

Apache Camel 4.0.0 < 4.18.5

Apache Camel 4.19.0 < 4.22.1

Apache Camel 4.18.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-79986
Created by oscerd