CVE-2026-91858: Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present
FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURESECUREPROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camel camel-fopto a version that resolves this vulnerability.Fixed in 4.23.0 - Configuration
Set ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET to the empty string on the TransformerFactory so external DTD and stylesheet access is refused.
FopProducer TransformerFactory ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET = empty string
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments where a third-party JAXP TransformerFactory is selected by TransformerFactory.newInstance() are affected. This can occur when Saxon-HE is on the classpath, for example through use of camel-xslt-saxon or camel-saxon.
Is a standard camel-fop deployment using the JDK transformer affected?
No. camel-fop does not include a third-party transformer factory itself, and the JDK built-in transformer refuses the external DTD and stylesheet access described when secure processing is enabled.
What access does an attacker need?
An attacker must be able to send an XSL-FO document that reaches a FOP producer. No authentication or user interaction is required according to the supplied vector.
What could exploitation allow?
A crafted document can cause external DTDs or entities to be resolved during transformation. This may allow reading files accessible to the Camel process and making requests to hosts named by the document.
How can I determine whether my application is exposed?
Check whether a third-party JAXP TransformerFactory, such as Saxon-HE, is present and selected by TransformerFactory.newInstance() in the runtime. Applications using camel-xslt-saxon or camel-saxon are examples where this condition may exist.