Severity:
CVSS 3.1: 6.5 (medium) CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected versions:
- Apache Camel (org.apache.camel:camel-fop) 4.0.0 before 4.18.5
- Apache Camel (org.apache.camel:camel-fop) 4.19.0 before 4.22.1
Description:
FopProducer transforms the incoming XSL-FO message body by creating a
javax.xml.transform.TransformerFactory through TransformerFactory.newInstance()
and enabling only FEATURE_SECURE_PROCESSING before running an identity
transform over the body. On the JDK's built-in transformer, that feature alone
already empties the accessExternalDTD and accessExternalStylesheet limits, so
an external DTD or entity is refused. When a third-party JAXP
TransformerFactory such as Saxon-HE is on the classpath, for example because
the application also uses camel-xslt-saxon or camel-saxon,
TransformerFactory.newInstance() returns that implementation instead, and
FEATURE_SECURE_PROCESSING on its own does not restrict external resource access
on it. A DOCTYPE with an external subset, or an external general entity,
declared in the XSL-FO document is then resolved and expanded while the body is
transformed. An external sender whose XSL-FO reaches a fop producer could
therefore read files readable by the Camel process and cause the process to
issue requests to hosts the document names. camel-fop does not bring such a
factory itself, and excludes Xalan, so a default deployment using the JDK
transformer is not affected; the issue is reachable only where another
component has placed an alternative JAXP TransformerFactory on the classpath.
Releases on the 4.14.x line and earlier reached end of life before this issue
was resolved and do not receive a fix.
Solution:
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If
users are on the 4.22.x releases stream, then they are suggested to upgrade to
4.22.1. If users are on the 4.18.x releases stream, then they are suggested to
upgrade to 4.18.5. FopProducer now also sets ACCESS_EXTERNAL_DTD and
ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory it
creates, in addition to FEATURE_SECURE_PROCESSING, matching the secure XML
processing configuration used by org.apache.camel.converter.jaxp.XmlConverter,
so external DTD and stylesheet access is refused on any JAXP implementation
that honours those attributes. The 4.14.x releases stream and earlier reached
end of life before this issue was resolved and will not receive a fix, so
deployments on those lines must move to a supported release.
Work Arounds:
For deployments that cannot upgrade immediately, do not send untrusted XSL-FO
to a fop producer. Alternatively, remove the third-party JAXP
TransformerFactory such as Saxon-HE from the classpath, so that the JDK's
built-in transformer is used, which already refuses external DTDs and external
entities when secure processing is enabled.
Credit:
Andrea Cosentino (finder)
Andrea Cosentino (remediation developer)
References:
https://camel.apache.org/security/CVE-2026-91858.html
https://issues.apache.org/jira/browse/CAMEL-24605
https://github.com/apache/camel/pull/26108
https://github.com/apache/camel/pull/26168
https://github.com/apache/camel/pull/26169
https://camel.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-91858
