Severity:
CVSS 3.1: 8.2 (high) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected versions:
- Apache Camel (org.apache.camel:camel-smooks) 4.7.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-smooks) 4.19.0 before 4.22.1
Description:
Improper Restriction of XML External Entity Reference vulnerability in Apache
Camel.
This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before
4.22.1.
Improper Restriction of XML External Entity Reference in the Smooks component
(camel-smooks) in Apache Camel allows an attacker who supplies the XML message
body to read local files or issue requests to internal network locations via an
external entity declaration in that body. This issue affects Apache Camel: from
4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format
(.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the
incoming XML body with the reader Smooks resolves by default, which is the
Woodstox SAX parser. That reader resolves external general and parameter
entities and loads external DTDs, and camel-smooks applied none of the parser
hardening that the other Camel XML components apply. A DOCTYPE with an external
subset, or an external general entity, declared in the XML document is
therefore resolved and expanded while the body is unmarshalled, and the
resolved content is bound into the unmarshalled result and returned on InOut
routes. An external sender whose XML reaches a camel-smooks data format or
endpoint could therefore read files readable by the Camel process and cause the
process to issue requests to hosts the document names. No non-default option is
required, since resolving external entities was the default behaviour.
Configurations that declare their own reader - EDI, CSV, JSON, or a custom
reader - do not use the XML reader and are not affected. Users are recommended
to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a
javax.xml.parsers.DocumentBuilder that does not resolve external general or
parameter entities and does not load external DTDs, and hands Smooks the
resulting document, matching the secure XML processing configuration used by
org.apache.camel.converter.jaxp.XmlConverter and the other Camel XML
components. This hardening is applied only when the Smooks configuration parses
XML with its default reader, so EDI, CSV, JSON and custom-reader
configurations, and the marshalling direction, are unchanged. A new
allowExternalEntities option, disabled by default, restores the previous
behaviour for trusted legacy configurations that rely on external entity
resolution. The camel-4.14.x releases stream and earlier reached end of life
before this issue was resolved and will not receive a fix, so deployments on
those lines must move to a supported release. For deployments that cannot
upgrade immediately, do not apply camel-smooks to XML received from untrusted
senders.
Solution:
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS
releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases
stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a
javax.xml.parsers.DocumentBuilder that does not resolve external general or
parameter entities and does not load external DTDs, and hands Smooks the
resulting document, matching the secure XML processing configuration used by
org.apache.camel.converter.jaxp.XmlConverter and the other Camel XML
components. This hardening is applied only when the Smooks configuration parses
XML with its default reader, so EDI, CSV, JSON and custom-reader
configurations, and the marshalling direction, are unchanged. A new
allowExternalEntities option, disabled by default, restores the previous
behaviour for trusted legacy configurations that rely on external entity
resolution. The camel-4.14.x releases stream and earlier reached end of life
before this issue was resolved and will not receive a fix, so deployments on
those lines must move to a supported release. For deployments that cannot
upgrade immediately, do not apply camel-smooks to XML received from untrusted
senders.
Work Arounds:
Do not apply the Smooks data format or the Smooks component to XML received
from untrusted senders. The camel-4.14.x releases stream and earlier reached
end of life before this issue was resolved and will not receive a fix, so
deployments on those lines must move to a supported release.
Credit:
h1ei1 (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-88901.html
https://issues.apache.org/jira/browse/CAMEL-24677
https://github.com/apache/camel/pull/26270
https://github.com/apache/camel/pull/26327
https://github.com/apache/camel/pull/26329
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-88901
