XML External Entity Vulnerability in Apache Camel by Apache Software Foundation

CVE-2026-85250

What is CVE-2026-85250?

A vulnerability exists in the Apache Camel XPath component due to improper handling of the XML document type InputSource. This flaw allows external entities specified in XML payloads to be processed, potentially granting an attacker access to files on the host or enabling requests to arbitrary hosts. This occurs when the underlying JDK parser is leveraged without adequate restrictions, making certain deployments vulnerable. To mitigate this issue, users are advised to upgrade to Apache Camel versions 4.23.0, 4.18.5, or 4.22.1 which enforce stricter parsing rules for the InputSource document type.

References