This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 51cea5216fe2ac5006458701a4f00034a3f83b41 Author: Andrea Cosentino <[email protected]> AuthorDate: Fri Sep 18 11:32:53 2026 +0200 Added CVE-2026-79985 Co-Authored-By: Claude Opus 5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-79985.md | 21 ++++++++++++++++++++ content/security/CVE-2026-79985.txt.asc | 35 +++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/content/security/CVE-2026-79985.md b/content/security/CVE-2026-79985.md new file mode 100644 index 00000000..e1b1f4cb --- /dev/null +++ b/content/security/CVE-2026-79985.md @@ -0,0 +1,21 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-79985" +date: 2026-09-18T10:00:00+02:00 +url: /security/CVE-2026-79985.html +draft: false +type: security-advisory +cve: CVE-2026-79985 +severity: HIGH +summary: "Camel-SMB: the consumer built the remote path of a polled file from the name reported in the share listing without constraining it to the polled directory, so a crafted listing entry could be retrieved, deleted or renamed outside it" +description: "The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs on, and a [...] +credit: "This issue was discovered by Dilrevx from NSSL, SJTU" +affected: "From 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24487 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25730 (commit 177fb1fdff90632ebfd27772a625b720c1cab3e7), backported to camel-4.22.x in https://github.com/apache/camel/pull/25745 (commit b31b1754d26352ea823354c8660074aaba257c45) and to camel-4.18.x in https://github.com/apache/camel/pull/25746 (commit c1165e4e663c3c3edc7bd30451ecc213fcf68cfd). A follow-up documentation change on main, https://github.com/apache/camel/pull/25747 (commit a7d7d3ad2e7f940ece35803a0929aa8215d [...] + +The issue is classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The affected range starts at 4.2.0 because the camel-smb component was introduced in that release. Its consumer walks the share listing on its own rather than through RemoteFileConsumer and skipped only the exact \".\" and \"..\" entries, so it received its own containment override. Reaching the issue requires a server that emits a listing name which is not a single path segm [...] diff --git a/content/security/CVE-2026-79985.txt.asc b/content/security/CVE-2026-79985.txt.asc new file mode 100644 index 00000000..50b7e37c --- /dev/null +++ b/content/security/CVE-2026-79985.txt.asc @@ -0,0 +1,35 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-79985" +date: 2026-09-18T10:00:00+02:00 +url: /security/CVE-2026-79985.html +draft: false +type: security-advisory +cve: CVE-2026-79985 +severity: HIGH +summary: "Camel-SMB: the consumer built the remote path of a polled file from the name reported in the share listing without constraining it to the polled directory, so a crafted listing entry could be retrieved, deleted or renamed outside it" +description: "The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on [...] +mitigation: "Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream. The fix adds a separator-aware GenericFileHelper.isWithinDirectory overload, since remote paths always use a forward slash regardless of the platform Camel runs on, and a [...] +credit: "This issue was discovered by Dilrevx from NSSL, SJTU" +affected: "From 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1." +fixed: 4.18.5, 4.22.1 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24487 refers to the various commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/25730 (commit 177fb1fdff90632ebfd27772a625b720c1cab3e7), backported to camel-4.22.x in https://github.com/apache/camel/pull/25745 (commit b31b1754d26352ea823354c8660074aaba257c45) and to camel-4.18.x in https://github.com/apache/camel/pull/25746 (commit c1165e4e663c3c3edc7bd30451ecc213fcf68cfd). A follow-up documentation change on main, https://github.com/apache/camel/pull/25747 (commit a7d7d3ad2e7f940ece35803a0929aa8215d [...] + +The issue is classified as CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). The affected range starts at 4.2.0 because the camel-smb component was introduced in that release. Its consumer walks the share listing on its own rather than through RemoteFileConsumer and skipped only the exact \".\" and \"..\" entries, so it received its own containment override. Reaching the issue requires a server that emits a listing name which is not a single path segm [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmqtBSwACgkQ406fOAL/ +QQBd4ggAk0OvkeoqlcphEKC72QM7Ifm0l/n+6FNRXpOqa5MG9P3fbwYEtGT+s8ax +OwU+RFcL52sU+Yx4kRj5N2WPEsrGHxi0S+bUjC7OM1wN/ujKBxD5lzPVPgx0WPjN +km0GuQAuXTVQ0yY59dySG12SVWOtLAhphTeVrcLdn0zOBzRN/jf9oclqs3jojYJG +F+B40ceysL2/CuyxgPaMTtSQzD/R5kwBGdeZu8delcj/PF9/zx21Mw/24zcoooEu +DvHCs6EUuZUTNaVphuhWsXa9MGzvRaF2jCRT89tZ5JFf3MJMyQhF8zNfVtvhSzsP +h+JjB4ybOAtmFEOA1WFZO5copgeZww== +=R+wx +-----END PGP SIGNATURE-----
