---
title: "CVE-2026-66906: Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir"
url: https://erroneo.us/security/cve/CVE-2026-66906/
description: "CVE-2026-66906 (org.apache.camel:camel-azure-storage-blob (Maven)): Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-08-24
date_modified: 2026-08-28
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-66906"
kev: false
cvss: 9.1
epss: 0.00776
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-66906: Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.8% , percentile 55: FIRST’s model estimates a 0.8% chance of exploitation activity in the next 30 days, higher than 55% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes org.apache.camel:camel-azure-storage-blob (Maven) >= 4.0.0, < 4.14.9, fixed in 4.14.9 ; org.apache.camel:camel-azure-storage-blob (Maven) >= 4.15.0, < 4.18.4, fixed in 4.18.4 ; org.apache.camel:camel-azure-storage-blob (Maven) >= 4.19.0, < 4.22.0, fixed in 4.22.0 . Check your lockfile, including transitive dependencies.

## What it is

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem through its downloadBlobToFile operation, writing into the directory named by the fileDir endpoint option, which is documented as usable from both the producer and the consumer. BlobOperations.downloadBlobToFile built the local target by joining fileDir with the remote blob name exactly as the Azure SDK reported it (new File(fileDir, client.getBlobName())) and passed the result straight to the SDK download call, with no lexical normalization and no check that the resolved location stayed inside fileDir. The blob name is not route-controlled data: the consumer enumerates the container in BlobConsumer.createBatchExchangesFromContainer, which lists blobs and creates one exchange per entry from BlobItem.getName() verbatim, applying no name filtering by default. A blob name containing parent-directory segments therefore resolved to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed container cause Camel to create or overwrite a file at a location of their choosing, with the privileges of the Camel process. Depending on what the process can write to, overwriting a file outside the download directory can escalate beyond the loss of integrity of that file. Azure Storage blob containers use a flat namespace in which the blob name is an opaque key, so a name carrying such segments is stored and listed as given. The fileDir option is an ordinary common-group configuration parameter and carries no security marker, so nothing signalled to users that its value was not being enforced as a containment boundary. Camel's other file-download consumers - camel-file, camel-ftp, camel-smb, camel-mina-sftp and camel-azure-files - already constrained their local downloads to the configured directory using a path-segment boundary check; the camel-azure-storage-blob download path was not covered by that work. Users are recommended to upgrade to version 4.22.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.9. If users are on the 4.18.x releases stream, then…

## Affected packages

- Maven `org.apache.camel:camel-azure-storage-blob` >= 4.0.0, < 4.14.9 → fixed: 4.14.9
- Maven `org.apache.camel:camel-azure-storage-blob` >= 4.15.0, < 4.18.4 → fixed: 4.18.4
- Maven `org.apache.camel:camel-azure-storage-blob` >= 4.19.0, < 4.22.0 → fixed: 4.22.0

## Affected products (CVE record)

- Apache Software Foundation Apache Camel: 4.0.0 < 4.14.9, 4.15.0 < 4.18.4, 4.19.0 < 4.22.0

## Severity

- CISA-ADP CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
- GitHub CVSS 3.1: 9.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable yes , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.78% probability of exploitation activity in the next 30 days; percentile 55.

## Sources

- [camel.apache.org](https://camel.apache.org/security/CVE-2026-66906.html)
- [GitHub Advisory GHSA-2x37-89hj-2j95](https://github.com/advisories/GHSA-2x37-89hj-2j95)
- [CVE.org record CVE-2026-66906](https://www.cve.org/CVERecord?id=CVE-2026-66906)
- [NVD entry CVE-2026-66906](https://nvd.nist.gov/vuln/detail/CVE-2026-66906)
- [openwall.com](http://www.openwall.com/lists/oss-security/2026/08/24/10)
- [github.com](https://github.com/apache/camel/pull/24581)
- [github.com](https://github.com/apache/camel/pull/24582)
- [github.com](https://github.com/apache/camel/pull/24585)
- [github.com](https://github.com/apache/camel/commit/007929bb732a8c5e3e49d4d3c6c8adc2aab13340)
- [github.com](https://github.com/apache/camel/commit/55fcbaf8bc1936cae90abdea5adecbc43e57340e)
- [github.com](https://github.com/apache/camel/commit/857d0cd3024b706ce80f3d2a4aa111e5e94a3e59)
- [github.com](https://github.com/apache/camel/releases/tag/camel-4.14.9)
- [github.com](https://github.com/apache/camel/releases/tag/camel-4.18.4)
- [github.com](https://github.com/apache/camel/releases/tag/camel-4.22.0)
- [issues.apache.org](https://issues.apache.org/jira/browse/CAMEL-23942)

---
Source page: https://erroneo.us/security/cve/CVE-2026-66906/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt