CVE-2026-79984 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Camel deployments, particularly those using the Mina SFTP component, should assess exposure and prioritize upgrades. This includes operators, security teams, and vulnerability management teams who need to verify remote file consumer configurations and review compensating controls for exposed systems.

Why it matters

CVE-2026-79984 allows an attacker to read, delete, or rename files outside the configured polling directory in Apache Camel Mina SFTP component.

• Verify remote file consumer configurations to prevent unauthorized file access
• Assess exposure in Apache Camel versions 4.18.0-4.22.1
• Prioritize upgrades to Apache Camel 4.23.0 or later

Technical summary

Apache Camel Mina SFTP component is vulnerable to path traversal due to improper limitation of a pathname to a restricted directory. This allows an attacker to read, delete, or rename files outside the configured polling directory. The vulnerability is caused by the component's failure to properly normalize and validate file paths, enabling an attacker to manipulate file operations using the endpoint's credentials. Affected versions include Apache Camel 4.18.0-4.22.1, and defenders should prioritize upgrades to Apache Camel 4.23.0 or later.

Defensive priority

Defenders should prioritize upgrading to Apache Camel 4.23.0 or later, and assess exposure in Apache Camel versions 4.18.0-4.22.1.

Recommended defensive actions

• Upgrade to Apache Camel 4.23.0 or later
• Assess exposure in Apache Camel versions 4.18.0-4.22.1
• Verify remote file consumer configurations to prevent unauthorized file access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. Apache Camel security advisories offer mitigation guidance. The issue is caused by the Mina SFTP component's improper handling of file paths, allowing attackers to escape the configured polling directory. Evidence from the CVE record and NVD detail page confirms the vulnerability's existence and provides details on affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.