Vulnerability intelligence

CVE-2026-103412

Apache Software Foundation Apache Camel Karavan CWE-22

Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container. This issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.

CVSS Score

8.8

High

EPSS — Exploit Probability

0.5%

Riskier than 42% of all CVEs · checked 2026-10-11

Exploitation

Not in CISA KEV

KEV does not include every exploited vulnerability

Remediation

Patch available

Vendor fix published

NVD entry Vendor patch PoC / advisory

No linked coverage yet. CyberSIXT tracks this CVE and coverage will appear here.

Related CVEs — Apache Software Foundation

CVE-2026-103413 CVE-2026-92414 CVE-2026-92415 CVE-2026-59265 CVE-2026-91135 CVE-2026-83632 CVE-2026-61373 CVE-2026-63772