Improper XML Entity Reference in Apache Camel Smooks Component

CVE-2026-88901

What is CVE-2026-88901?

The Smooks component in Apache Camel is vulnerable to an improper restriction of XML external entity references. This vulnerability allows an attacker who manipulates XML message bodies to read files from the local system or to send requests to internal network locations through external entity declarations. Specifically, the XML processing within the camel-smooks module uses the Woodstox SAX parser, failing to apply necessary parser hardening. As a result, the system can resolve and expand external entities and DTDs, exposing sensitive information and network locations. Users are advised to upgrade to corrected versions of Apache Camel, namely 4.18.5, 4.22.1, or 4.23.0, to mitigate these risks.

References