XML Transformation Vulnerability in Apache Camel FopProducer

CVE-2026-91858

What is CVE-2026-91858?

The FopProducer component in Apache Camel is susceptible to vulnerabilities stemming from improper handling of external resources during XML transformations. Specifically, when utilizing a third-party JAXP TransformerFactory, unauthorized access to external DTDs or entities may occur, allowing attackers to read files within the Camel process environment and potentially make external requests. This situation arises when an alternative TransformerFactory is unintentionally loaded on the classpath, permitting exploitation through maliciously crafted XSL-FO documents. To mitigate risks, users should ensure they are using supported versions of Apache Camel and should update to secure releases post-4.14.x.

References