CVE-2026-79983High· 7.4▾ MidnightPoC availableA flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 40.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
0.5%
0.5% → 0.7%
1 GitHub repo (last check)
A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or network attacker modifying server responses can supply crafted file paths, causing Camel to retrieve, rename, or delete files outside the intended boundary using the application's credentials. This flaw leads to unauthorized data disclosure and unexpected file modifications on the remote system.
org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-21.
Affected:
No fix planned:
Affected
Workarounds / mitigations:
The highest-value action is to enforce path normalization and boundary containment checks on remote directory lis…
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85250High· 7.5org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references (CVE-2026-85250)
CVE-2026-55888High· 8.2xdg-desktop-portal: xdg-desktop-portal: Unauthorized host file access via unvalidated FileChooser filenames (CVE-2026-55888)
CVE-2026-115354Medium· 6.5mistune: mistune: Information disclosure via path traversal in Include directive (CVE-2026-115354)
CVE-2026-114140High· 7.8nbconvert: nbconvert: arbitrary file write via path traversal in ExtractOutputPreprocessor (CVE-2026-114140)
CVE-2026-91396Medium· 6.5openjdk: Improve Pack200 handling (Oracle CPU 2026-10) (CVE-2026-91396)
CVE-2026-91395Medium· 6.5openjdk: Enhance Pack200 unpacking (Oracle CPU 2026-10) (CVE-2026-91395)