Executive brief
Apache Camel's Azure Storage Blob component downloads files from cloud storage to local disk. When downloading a blob to the local filesystem, the component failed to validate that blob names stay within the configured download directory, allowing an attacker who can create blob names with path traversal sequences (like `../`) to write files anywhere the Camel process has permissions. This could lead to arbitrary file creation, data corruption, or application compromise depending on the Camel process privileges.
Technical details
A relative path traversal vulnerability exists in the camel-azure-storage-blob component's downloadBlobToFile operation (CWE-23). The vulnerability occurs in BlobOperations.downloadBlobToFile, which constructs the local download path by joining the configured fileDir with the remote blob name (via `new File(fileDir, client.getBlobName())`) without validating that the result stays within the configured directory. The blob name originates untrusted from BlobConsumer.createBatchExchangesFromContainer, which enumerates container blobs verbatim from BlobItem.getName() with no default filtering. Because Azure Storage blob containers use a flat namespace, blob names containing parent-directory traversal sequences (e.g., `../../../etc/passwd`) are stored and listed literally, allowing an attacker with container write access to craft malicious blob names and cause Camel to write files outside the configured fileDir boundary with the privileges of the Camel process. Patches are available in versions 4.14.9, 4.18.4, and 4.22.0. Mitigations include applying a regex filter to reject path-traversal patterns before processing, or avoiding untrusted containers for this operation.
Affected products
- Apache Camel 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x
- Apache camel-azure-storage-blob 4.0.0 to 4.14.8, 4.15.0 to 4.18.3, 4.19.0 to 4.21.x
Timeline
- 2026-08-24: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-08-24: patched: Patches released: version 4.14.9, 4.18.4, and 4.22.0