https://seclists.org/oss-sec/2026/q3/564: CVE-2026-66906: Apache Camel: Camel-Azu-Storage-Blob: the downloadBlobToFile operation built the local download target from the mote blob name without constraining it to the configud fileDir

Q: Which deployments are exposed?

Deployments using the org.apache.camel:camel-azure-storage-blob component are exposed when they use the downloadBlobToFile operation with the fileDir endpoint option. The fileDir option is usable by both producers and consumers; consumers enumerate blob names from the container rather than treating them as route-controlled data.

Q: What input drives the filesystem write location?

The component built the target path by joining fileDir with the blob name returned by the Azure SDK. It did not normalize the resulting path or verify that the resolved location remained within fileDir.

Q: Which versions need to be upgraded?

Affected versions are 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0. The fixed versions identified by the advisory are 4.14.9, 4.18.4, and 4.22.0.

Published Aug 24, 2026

Updated

Affected Software

1 affected component

Apache Camel camel-azure-storage-blob>4.0.0<4.14.9, >4.15.0<4.18.4, >4.19.0<4.22.0

Frequently Asked Questions

Which deployments are exposed?

Deployments using the org.apache.camel:camel-azure-storage-blob component are exposed when they use the downloadBlobToFile operation with the fileDir endpoint option. The fileDir option is usable by both producers and consumers; consumers enumerate blob names from the container rather than treating them as route-controlled data.

What input drives the filesystem write location?

The component built the target path by joining fileDir with the blob name returned by the Azure SDK. It did not normalize the resulting path or verify that the resolved location remained within fileDir.

Which versions need to be upgraded?

Affected versions are 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0. The fixed versions identified by the advisory are 4.14.9, 4.18.4, and 4.22.0.

https://seclists.org/oss-sec/2026/q3/564: CVE-2026-66906: Apache Camel: Camel-Azu-Storage-Blob: the downloadBlobToFile operation built the local download target from the mote blob name without constraining it to the configud fileDir

Affected Software

Frequently Asked Questions

Which deployments are exposed?

What input drives the filesystem write location?

Which versions need to be upgraded?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What input drives the filesystem write location?

Which versions need to be upgraded?