CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.
A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing ../ sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container.
This issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1.
Users are recommended to upgrade to version 4.22.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camel Karavanto a version that resolves this vulnerability.Fixed in 4.22.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Karavan user, regardless of role, can exploit it. The attacker must be able to supply a project file name through the project file API and trigger a Git commit workflow.
What is the practical impact of successful exploitation?
An attacker can write file content outside the intended project directory to locations writable by the Karavan process. This can allow overwriting application configuration or classpath files and lead to code execution in the Karavan container.
Which installations are affected, and what is the fix?
Apache Camel Karavan versions from 3.18.0 before 4.22.1 are affected. Upgrade to version 4.22.1.