https://seclists.org/oss-sec/2026/q3/565: CVE-2026-66907: Apache Camel: Camel-Google-Storage: the consumer appended the mote object name to the configud downloadFileName dictory without constraining the sult

Q: Which deployments are exposed?

Deployments using the camel-google-storage consumer are affected when the downloadFileName option is set. The described unsafe path construction occurs when downloadFileName contains no expression token, causing the consumer to append the remote object name.

Q: What input influences the local download path?

The consumer sets the Exchange file-name header to the remote object name and evaluates it through ${file:name}. That token returns the header verbatim, and the resulting value was passed to File and blob.downloadTo without lexical normalization or a containment check.

Q: Which versions include a fix?

Upgrade camel-google-storage to 4.14.9 or later in the 4.0.x line, 4.18.4 or later in the 4.15.x line, or 4.22.0 or later in the 4.19.x line.

Published Aug 24, 2026

Updated

Affected Software

3 affected components

Apache Camel>4.0.0<4.14.9

Apache Camel>4.15.0<4.18.4

Apache Camel>4.19.0<4.22.0

Frequently Asked Questions

Which deployments are exposed?

Deployments using the camel-google-storage consumer are affected when the downloadFileName option is set. The described unsafe path construction occurs when downloadFileName contains no expression token, causing the consumer to append the remote object name.

What input influences the local download path?

The consumer sets the Exchange file-name header to the remote object name and evaluates it through ${file:name}. That token returns the header verbatim, and the resulting value was passed to File and blob.downloadTo without lexical normalization or a containment check.

Which versions include a fix?

Upgrade camel-google-storage to 4.14.9 or later in the 4.0.x line, 4.18.4 or later in the 4.15.x line, or 4.22.0 or later in the 4.19.x line.