CVE-2026-103412 in Camel Karavan
Summary
by MITRE • 10/09/2026
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan.
A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container.
This issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1.
Users are recommended to upgrade to version 4.22.1, which fixes the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Apache Camel Karavan represents a critical path traversal flaw that allows authenticated users to write files outside of their designated project directories. This security defect stems from an improper limitation on pathname construction within the application's file handling mechanisms. Specifically, when a user interacts with the project file API to create or modify a project, the system accepts the provided filename and uses it verbatim as a path segment during Git commit operations. The core technical failure lies in the lack of sanitization for directory traversal sequences such as ../ within these filenames. By embedding these relative path indicators into the filename string, an attacker can manipulate the resulting file path to escape the intended working copy directory structure. This behavior violates fundamental security principles regarding input validation and secure resource access control, allowing data written by the application to be directed to arbitrary locations on the underlying filesystem that are writable by the Karavan process user account.
The operational impact of this vulnerability is severe due to its potential for remote code execution within the containerized environment hosting Apache Camel Karavan. Since an authenticated user with any role can exploit this flaw, even low-privilege accounts pose a significant risk. By overwriting application configuration files or critical components located on the application classpath, an attacker can inject malicious logic that is subsequently loaded and executed by the Java Virtual Machine running the Karavan service. This effectively grants the attacker control over the execution context of the container, potentially leading to full system compromise depending on the privileges assigned to the process. The ability to write arbitrary files means attackers could also plant backdoors, exfiltrate sensitive data from other accessible directories, or disrupt service availability by corrupting essential application binaries and configuration settings.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within file paths that can cause files to be located outside of the intended restricted directory or database. Furthermore, in terms of adversary tactics and techniques, this exploit maps directly to ATT&CK technique T1048: Exfiltration Over Alternative Protocol if used for data theft, but more critically it facilitates T1505.003: Web Shell: Cloud Service which involves placing malicious files into web-accessible or executable directories like the classpath to achieve persistent access and code execution. The vulnerability also touches upon CWE-94: Improper Control of Generation of Code (Code Injection) because the ultimate goal is often to execute arbitrary code by manipulating how the application loads its components at runtime.
To mitigate this risk, immediate action must be taken to upgrade Apache Camel Karavan to version 4.22.1 or later, where the issue has been resolved through improved input validation and path normalization logic. Until an upgrade can be performed, administrators should consider implementing strict network segmentation to limit access to the Karavan interface only from trusted sources with verified identities. Additionally, running the application container under a restricted user account with minimal filesystem permissions can help contain the blast radius of such an exploit by preventing writes to critical system directories or classpaths outside the designated project scope. Regular auditing of file write operations and monitoring for unusual path traversal patterns in access logs can also aid in early detection of attempted exploitation activities.