CVE-2026-79983 Apache Software Foundation CVE debrief

Who should care

Apache Camel users, especially those using FTP, FTPS, or SFTP schemes, should assess their exposure and upgrade to a fixed version. This includes reviewing specific endpoint configurations and server settings to ensure that the vulnerability is properly mitigated. Additionally, users should verify that their current version of Apache Camel is affected and prioritize remediation accordingly.

Why it matters

Apache Camel's FTP component has a Path Traversal vulnerability allowing remote file access, deletion, or renaming outside the configured polling directory. Defenders should assess exposure, prioritize remediation, and verify specific endpoint configurations and server settings.

• Potential unauthorized file access outside the configured polling directory
• Potential file deletion or renaming outside the configured polling directory
• Requires verification of affected versions and remediation priority
• Exposure depends on specific endpoint configurations and server settings

Technical summary

The vulnerability exists in Apache Camel's FTP component, specifically in the remote-file consumers that poll a directory on a remote server. The issue arises from the concatenation of the configured directory with the file name reported in the server's directory listing, which applies no lexical normalization and no check that the result stays inside the directory being polled. This allows an attacker to access, delete, or rename files outside the configured polling directory.

Defensive priority

High priority for Apache Camel users, especially those using FTP, FTPS, or SFTP schemes.

Recommended defensive actions

• Upgrade to Apache Camel 4.23.0 or later
• Users on the 4.22.x releases stream should upgrade to 4.22.1
• Users on the 4.18.x LTS releases stream should upgrade to 4.18.5
• Review and restrict FTP, FTPS, and SFTP endpoint configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in Apache Camel's FTP component, specifically in the remote-file consumers that poll a directory on a remote server. The issue arises from the concatenation of the configured directory with the file name reported in the server's directory listing, which applies no lexical normalization and no check that the result stays inside the directory being polled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.