Executive brief
Apache Camel's Azure Data Lake Storage connector allows organizations to automatically download files from cloud storage to a local directory. A flaw in the downloadToFile operation permits attackers who can add files to the remote storage to craft filenames containing path traversal sequences (such as "../"), causing Camel to write those files to arbitrary locations on the server's filesystem. This could allow an attacker to overwrite critical configuration files or other data with the permissions of the Camel process, potentially compromising system integrity or availability.
Technical details
The vulnerability exists in the DataLakeFileOperations.downloadToFile method, which constructs the local download target by concatenating the configured fileDir with the remote filename (new File(fileDir, fileClientWrapper.getFileName())) without any lexical normalization or boundary validation. The remote filename comes directly from the Data Lake filesystem listing (PathItem.getName()) with no filtering applied by default. An attacker who can influence object names in the remotely-writable Data Lake filesystem can inject path traversal sequences (e.g., "../../../etc/passwd") that resolve to locations outside fileDir. The vulnerable versions are 4.0.0–4.14.8, 4.15.0–4.18.3, and 4.19.0–4.21.x. Patches are available in versions 4.14.9, 4.18.4, and 4.22.0. The attack requires local or adjacent network access and low privileges; mitigations include upgrading, using the regex endpoint option to filter path names, or avoiding downloadToFile on untrusted filesystems.
Affected products
- Apache Camel 4.0.0 through 4.14.8, 4.15.0 through 4.18.3, 4.19.0 through 4.21.x
- Apache Camel Azure-Storage-DataLake Component 4.0.0 through 4.14.8, 4.15.0 through 4.18.3, 4.19.0 through 4.21.x
Timeline
- 2026-08-24: disclosed
- 2026-08-24: patched: Patches released: version 4.14.9, 4.18.4, and 4.22.0