Executive brief
Apache Camel's Google Cloud Storage component contains a path traversal flaw that allows remote file overwrite on the local system when downloading objects. An attacker who can control object names in a Google Cloud Storage bucket can craft names with directory-traversal sequences (like "../") to write files outside the intended download directory with the privileges of the Camel process. This could lead to arbitrary file creation or overwrite, potentially compromising system integrity.
Technical details
This is a relative path traversal vulnerability (CWE-23) in the camel-google-storage consumer component. When the downloadFileName option is set, the consumer downloads GCS objects to the local filesystem by concatenating the configured directory path with the remote object name using the ${file:name} token. The vulnerable code path does not normalize or validate the object name; it passes the concatenated path directly to File() and downloadTo() without checking that the result stays within the configured directory. Since GCS object names are opaque UTF-8 keys stored and listed exactly as written (with no server-side canonicalization), an attacker who can write objects to the bucket can embed parent-directory segments ("../" equivalents) in the object name to escape the intended download directory. The filter option that could restrict object names is not applied unless explicitly set. The fix adds path-segment boundary checking to constrain downloads, similar to existing protections in other Camel file-download consumers. Patches are available in versions 4.14.9, 4.18.4, and 4.22.0.
Affected products
- Apache Camel Google Storage 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, 4.19.0 before 4.22.0
Timeline
- 2026-08-24: disclosed: Advisory published
- 2026-08-24: patched: Fixes released in versions 4.14.9, 4.18.4, and 4.22.0