A critical path traversal vulnerability in Apache Camel permits unauthenticated remote attackers to perform arbitrary file writes, creating a significant risk of system compromise.

The camel-azure-storage-blob component fails to sanitize blob names retrieved from Azure Storage before using them to construct local file paths. An unauthenticated attacker can manipulate blob names to escape the intended directory, facilitating unauthorized file writes outside the designated storage folder.

This vulnerability carries a CVSS score of 9.1, reflecting a critical severity level due to the potential for arbitrary file writes. Successful exploitation could lead to full system compromise, such as the overwriting of configuration files or the placement of malicious scripts, resulting in unauthorized access or complete service disruption.

Immediate Action: Upgrade to Apache Camel versions 4.14.9, 4.18.4, 4.22.0, or later to incorporate the necessary path sanitization fixes.

Proactive Monitoring: Review application logs and file system integrity monitoring reports for unexpected file creation events within unauthorized directories.

Compensating Controls: Implement strict egress filtering and ensure that the service account running the Apache Camel instance operates with the least privilege necessary, specifically restricting write access to the minimum required file system locations.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository https://github.com/oscerd/CVE-2026-66906.

Given the critical CVSS score and the public availability of a proof-of-concept, organizations using the affected Apache Camel versions must prioritize this update. Immediate patching is the only effective way to prevent potential remote code execution or system takeover resulting from this path traversal flaw.