{"id":"CVE-2026-85250","title":"org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references (CVE-2026-85250)","summary":"A flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A re…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-611","vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","affected":["build_of_apache_camel_4_for_quarkus 3","build_of_apache_camel_for_spring_boot 4","fuse 7"],"published":"2026-10-19","updated":"2026-10-20","sourceUpdated":"2026-10-20T08:38:34+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85250.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85250.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-85250"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555511"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85250"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85250"},{"url":"https://camel.apache.org/security/CVE-2026-85250.html"},{"url":"https://github.com/apache/camel/pull/25683"},{"url":"https://github.com/apache/camel/pull/25940"},{"url":"https://github.com/apache/camel/pull/25942"},{"url":"https://issues.apache.org/jira/browse/CAMEL-24475"}],"tags":["csaf","vex","red-hat","exploit-available","cve.org"],"exploits":{"github":1,"githubRepos":["https://github.com/oscerd/CVE-2026-85250"],"checkedAt":"2026-10-27T19:18:02.436Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-19T16:50:01.891861Z"},"ingestedAt":"2026-10-19T12:27:23.814Z","epss":0.00559,"epssPercentile":0.46365,"slug":"CVE-2026-85250","body":"## Overview\n\nA flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A remote attacker can exploit this flaw by submitting specially crafted XML data containing external entity references, allowing them to read sensitive local files accessible to the application process or trigger outbound network requests.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85250.json)\n\n**org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-20.\n\nAffected:\n\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n- Red Hat Fuse 7\n\nNo fix planned:\n\n- Red Hat Fuse 7\n- Red Hat build of Apache Camel 4 for Quarkus 3\n- Red Hat build of Apache Camel for Spring Boot 4\n\nNot affected:\n\n- Red Hat build of Apache Camel - HawtIO 4\n\n## Remediation\n\nOut of support scope","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":225684,"id":"CVE-2026-85250","ts":1792498356503,"field":"exploit_available","old":"false","new":"true"}]}