CVE-2026-60093 Apache CVE debrief

Who should care

Defenders responsible for Apache Camel deployments, particularly those using the camel-azure-storage-datalake component, should assess exposure and apply mitigations or upgrades. This includes reviewing the current deployment configurations, identifying potential vulnerabilities, and implementing necessary security measures.

Why it matters

CVE-2026-60093 is a relative path traversal vulnerability in the Apache Camel Azure-Storage Datalake component. Defenders should care because it can lead to file overwrite or creation outside the download directory, potentially escalating beyond integrity loss. Affected deployments should upgrade to fixed versions or apply mitigations.

• Potential file overwrite or creation outside the download directory
• Escalation beyond the loss of integrity of the file
• Need to verify affected versions and apply upgrades or mitigations

Technical summary

The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to the local filesystem through its downloadToFile operation. A path name containing parent-directory segments can resolve to a location outside the configured fileDir, letting anyone able to influence the names present in the consumed Data Lake filesystem cause Camel to create or overwrite a file at a location of their choosing.

Defensive priority

Upgrade to fixed version or apply mitigations

Recommended defensive actions

• Upgrade to Apache Camel version 4.22.0 or later
• Apply mitigations: constrain names the consumer will act on using the regex endpoint option
• Avoid the downloadToFile operation on untrusted filesystems
• Verify affected versions and apply upgrades or mitigations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The vulnerability is caused by the lack of lexical normalization and directory checks in the DataLakeFileOperations.downloadToFile method. The issue affects Apache Camel versions from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, and from 4.19.0 before 4.22.0. Users are recommended to upgrade to version 4.22.0 or apply mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.