---
id: CVE-2026-85250
title: >-
  org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML
  external entity references (CVE-2026-85250)
summary: >-
  A flaw was found in Apache Camel's XPath component. This vulnerability can
  lead to information disclosure and unauthorized network requests when the
  component evaluates XML expressions using unhardened streaming parser
  configurations. A re…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe: CWE-611
vendor: Red Hat
product: Red Hat build of Apache Camel 4 for Quarkus 3
affected:
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - fuse 7
published: '2026-10-19'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T08:38:34+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85250.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85250.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-85250'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555511'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-85250'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85250'
  - url: 'https://camel.apache.org/security/CVE-2026-85250.html'
  - url: 'https://github.com/apache/camel/pull/25683'
  - url: 'https://github.com/apache/camel/pull/25940'
  - url: 'https://github.com/apache/camel/pull/25942'
  - url: 'https://issues.apache.org/jira/browse/CAMEL-24475'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - cve.org
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/oscerd/CVE-2026-85250'
  checkedAt: '2026-10-27T19:18:02.436Z'
exploitAvailable: true
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-19T16:50:01.891861Z'
ingestedAt: '2026-10-19T12:27:23.814Z'
epss: 0.00559
epssPercentile: 0.46365
---

## Overview

A flaw was found in Apache Camel's XPath component. This vulnerability can lead to information disclosure and unauthorized network requests when the component evaluates XML expressions using unhardened streaming parser configurations. A remote attacker can exploit this flaw by submitting specially crafted XML data containing external entity references, allowing them to read sensitive local files accessible to the application process or trigger outbound network requests.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat Fuse 7 · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-85250.json)

**org.apache.camel/camel-xpath: camel-xpath: Information disclosure via XML external entity references** — rated Important by Red Hat. Released 2026-10-19, updated 2026-10-20.

Affected:

- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Fuse 7

No fix planned:

- Red Hat Fuse 7
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4

Not affected:

- Red Hat build of Apache Camel - HawtIO 4

## Remediation

Out of support scope