CVE-2026-79985 Apache Software Foundation CVE debrief

Who should care

Defenders of Apache Camel deployments, particularly those using the SMB component, should assess exposure and prioritize patching. This vulnerability can be exploited by an attacker with access to the SMB share, potentially leading to unauthorized file operations.

Why it matters

CVE-2026-79985 is a high-severity Path Traversal vulnerability in Apache Camel's SMB component. Defenders should prioritize patching and review SMB share configurations to prevent unauthorized file operations. The vulnerability allows an attacker to escape the polling directory and perform file operations outside the intended scope, using the endpoint's credentials.

• Potential unauthorized file reads outside the polling directory
• Possible deletion of files outside the intended directory
• Potential renaming of files outside the intended directory
• Verification of file access controls and SMB share configurations is required

Technical summary

The Apache Camel SMB component is vulnerable to a Path Traversal attack. This occurs because the component does not properly normalize and validate file paths when polling a remote directory. An attacker can manipulate the directory listing response to access files outside the configured polling directory, potentially leading to unauthorized file reads, deletions, or renames. The vulnerability affects Apache Camel versions from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The issue is corrected in Apache Camel 4.23.0. Defenders should prioritize patching and review SMB share configurations to prevent unauthorized file operations.

Defensive priority

High

Recommended defensive actions

• Upgrade to Apache Camel 4.23.0 or later
• Apply patches for affected versions (4.18.x to 4.22.x)
• Review and restrict access to SMB shares
• Monitor for suspicious file operations
• Perform vulnerability scanning to identify exposed systems
• Review system logs for signs of exploitation
• Implement additional security controls to prevent similar vulnerabilities

Evidence notes

The CVE record and Apache Camel security advisory provide details on the vulnerability. The NVD entry is currently Undergoing Analysis. Defenders should verify the affected versions of Apache Camel and review SMB share configurations to prevent unauthorized file operations. Evidence is limited to public sources and may not be comprehensive. Further verification is required to confirm the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.