CVE-2026-60093
1 advisory.
Maven/org.apache.camel:camel-azure-storage-datalake CVE-2026-60093: medium 5.5, EPSS 0.24%
Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
Action: Upgrade org.apache.camel:camel-azure-storage-datalake to 4.14.9 (4.14.x), 4.18.4 (4.18.x) or 4.22.0 (4.22.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.14.9 | - |
| 4.15.0 | 4.18.4 | - |
| 4.19.0 | 4.22.0 | - |
Fixed versions
| 4.14.9 | 4.18.4 | 4.22.0 |
Sources
- osv: GHSA-7jwc-q3fj-c9pq
- https://nvd.nist.gov/vuln/detail/CVE-2026-60093
- https://github.com/apache/camel/pull/24542
- https://github.com/apache/camel/pull/24581
- https://github.com/apache/camel/pull/24582
- https://github.com/apache/camel/pull/24585
- https://github.com/apache/camel/commit/007929bb732a8c5e3e49d4d3c6c8adc2aab13340
- https://github.com/apache/camel/commit/55fcbaf8bc1936cae90abdea5adecbc43e57340e
- https://github.com/apache/camel/commit/857d0cd3024b706ce80f3d2a4aa111e5e94a3e59
- https://camel.apache.org/security/CVE-2026-60093.html
- https://github.com/apache/camel
- https://github.com/apache/camel/releases/tag/camel-4.14.9
- https://github.com/apache/camel/releases/tag/camel-4.18.4
- https://github.com/apache/camel/releases/tag/camel-4.22.0
- https://issues.apache.org/jira/browse/CAMEL-23942
- http://www.openwall.com/lists/oss-security/2026/08/24/8
CVE-2026-60093 · published · modified · JSON