---
id: CVE-2026-79983
title: >-
  org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via
  path traversal (CVE-2026-79983)
summary: >-
  A flaw was found in the Apache Camel FTP component. Remote-file consumers fail
  to validate directory listing entries received from remote servers, which
  allows path traversal outside the configured target directory. A compromised
  server or…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: vendor
cwe: CWE-22
vendor: Red Hat
product: Red Hat build of Apache Camel 4 for Quarkus 3
affected:
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - fuse 7
published: '2026-10-19'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T07:59:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79983.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79983.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-79983'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555484'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-79983'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-79983'
  - url: 'https://camel.apache.org/security/CVE-2026-79983.html'
  - url: 'https://github.com/apache/camel/pull/25730'
  - url: 'https://github.com/apache/camel/pull/25745'
  - url: 'https://github.com/apache/camel/pull/25746'
  - url: 'https://github.com/apache/camel/pull/25747'
  - url: 'https://issues.apache.org/jira/browse/CAMEL-24487'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
epss: 0.00659
epssPercentile: 0.51334
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/oscerd/CVE-2026-79983'
  checkedAt: '2026-10-27T19:14:17.064Z'
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-20T03:55:34.627383Z'
ingestedAt: '2026-10-19T11:23:01.766Z'
---

## Overview

A flaw was found in the Apache Camel FTP component. Remote-file consumers fail to validate directory listing entries received from remote servers, which allows path traversal outside the configured target directory. A compromised server or network attacker modifying server responses can supply crafted file paths, causing Camel to retrieve, rename, or delete files outside the intended boundary using the application's credentials. This flaw leads to unauthorized data disclosure and unexpected file modifications on the remote system.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7 · no fix planned: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7 · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-79983.json)

**org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-21.

Affected:

- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Fuse 7

No fix planned:

- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Fuse 7

## Remediation

Affected

Workarounds / mitigations:

- --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce path normalization and boundary containment checks on remote directory lis…