CVE-2026-85250High· 7.5▾ MidnightPoC availableA flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A re…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
Last analysed / modified upstream
1 GitHub repo
0.5%
0.5% → 0.6%
A flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A remote attacker can exploit this flaw by submitting specially crafted XML data containing external entity references, allowing them to read sensitive local files accessible to the application process or trigger outbound network requests.
org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-20.
Affected:
No fix planned:
Not affected:
Out of support scope
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-79983High· 7.4org.apache.camel/camel-ftp: camel-ftp: Unauthorized remote file access via path traversal (CVE-2026-79983)
CVE-2025-59952High· 7.5MinIO Java SDK is a Simple Storage Service (aka S3) client to perform bucket and object operations to any Amazon S3 compatible object storage service
CVE-2026-17615High· 7.5A flaw was found in RESTEasy's SourceProvider
CVE-2026-33454Critical· 9.4The Camel-Mail component is vulnerable to Camel message header injection
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)