Apache Camel Azure Storage Blob: Path Traversal Vulnerability Under Investigation
- Severity
- HIGH
- Affected component
- camel-azure-storage-blob (maven)
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Apache Camel Azure Storage Blob component. This vulnerability, which is under investigation, could allow an attacker to overwrite files outside the intended directory.
What happened
The vulnerability is a relative path traversal issue in the downloadBlobToFile operation. This operation constructs the local download target from the remote blob name without properly constraining it to the configured file directory. The affected versions are 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, and 4.19.0 before 4.22.0.
This vulnerability has been tracked under GHSA-2X37-89HJ-2J95 and is associated with CVE-2026-66906. It has not been exploited in the wild as of the latest reports. Users of the camel-azure-storage-blob Maven package within the specified version ranges should assess their exposure and prepare for an upgrade once a fix is available.
What to do about it
- Review your project dependencies to identify if you are using the camel-azure-storage-blob component within the affected version ranges.
- If you are using an affected version, prepare to upgrade to a fixed version once it is released.
- Monitor the official sources for updates on the vulnerability and any available patches.
- Consider implementing additional security measures to mitigate the risk of path traversal attacks until a patch is available.
How 0Day would have caught this
camel-azure-storage-blob is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the camel-azure-storage-blob component in versions 4.0.0 before 4.14.9, 4.15.0 before 4.18.4, or 4.19.0 before 4.22.0.
What should I do right now?
Review your dependencies and prepare to upgrade to a fixed version once it is available. Monitor the official sources for updates.
Is there a patch available?
No official fix has been published yet. Monitor the sources for updates on a patched version.