{"action":"Upgrade org.apache.camel:camel-azure-storage-datalake to 4.14.9 (4.14.x), 4.18.4 (4.18.x) or 4.22.0 (4.22.x) or later.","affected":[{"fixed":"4.14.9","introduced":"4.0.0"},{"fixed":"4.18.4","introduced":"4.15.0"},{"fixed":"4.22.0","introduced":"4.19.0"}],"component":"org.apache.camel:camel-azure-storage-datalake","cve_ids":["CVE-2026-60093"],"ecosystem":"Maven","epss":0.00237,"exploited":false,"fixed_versions":["4.14.9","4.18.4","4.22.0"],"ghsa_id":"GHSA-7jwc-q3fj-c9pq","id":"tcs_01M5N8JJZZ7KXY6G6CDQ1E2ESV","modified_at":"2026-08-28T20:55:37.992875Z","published_at":"2026-08-24T18:31:51Z","references":["https://osv.dev/vulnerability/GHSA-7jwc-q3fj-c9pq","https://nvd.nist.gov/vuln/detail/CVE-2026-60093","https://github.com/apache/camel/pull/24542","https://github.com/apache/camel/pull/24581","https://github.com/apache/camel/pull/24582","https://github.com/apache/camel/pull/24585","https://github.com/apache/camel/commit/007929bb732a8c5e3e49d4d3c6c8adc2aab13340","https://github.com/apache/camel/commit/55fcbaf8bc1936cae90abdea5adecbc43e57340e","https://github.com/apache/camel/commit/857d0cd3024b706ce80f3d2a4aa111e5e94a3e59","https://camel.apache.org/security/CVE-2026-60093.html","https://github.com/apache/camel","https://github.com/apache/camel/releases/tag/camel-4.14.9","https://github.com/apache/camel/releases/tag/camel-4.18.4","https://github.com/apache/camel/releases/tag/camel-4.22.0","https://issues.apache.org/jira/browse/CAMEL-23942","http://www.openwall.com/lists/oss-security/2026/08/24/8"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-7jwc-q3fj-c9pq","url":"https://osv.dev/vulnerability/GHSA-7jwc-q3fj-c9pq"}],"summary":"Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir"}