An unauthenticated relative path traversal vulnerability in Apache Camel enables arbitrary file write operations, posing a high risk to system integrity.

The vulnerability exists in the camel-google-storage consumer, which fails to sanitize file paths when the downloadFileName option is utilized. An unauthenticated attacker can leverage this path traversal flaw to write files to unauthorized locations on the local filesystem by manipulating object names in a Google Cloud Storage bucket.

Successful exploitation allows an attacker to write files to arbitrary locations on the host system, which could lead to remote code execution or the overwriting of critical system configuration files. With a CVSS score of 7.5, this vulnerability represents a significant risk to the confidentiality and integrity of the hosting environment, necessitating immediate attention to prevent unauthorized system modification.

Immediate Action: Upgrade to Apache Camel version 4.14.9, 4.18.4, 4.22.0, or any later release that incorporates the security fix.

Proactive Monitoring: Review application logs for unusual file system activity or unexpected file paths being created by the Google Storage component.

Compensating Controls: Implement strict file system permissions for the service account running Apache Camel to ensure it only has write access to designated directories, limiting the impact of a potential traversal.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository at https://github.com/oscerd/CVE-2026-66907.

Given the potential for arbitrary file writes and the availability of a public proof-of-concept, this vulnerability should be treated as a high-priority remediation task. Administrators must verify their Apache Camel versions and apply the necessary updates immediately to secure the environment against potential exploitation.