Apache Camel Karavan Patch Fixes High-Severity Path Traversal Flaw

Apache Software Foundation has released version 4.22.1 of Apache Camel Karavan to address a high-severity path traversal vulnerability that allows authenticated attackers to execute arbitrary code. The flaw, tracked as CVE-2026-103412, stems from improper validation of file names when projects are committed to Git.

The vulnerability arises because the application uses project file names supplied through the project file API verbatim as path segments when writing to the working copy for a Git commit. If an attacker supplies a filename containing `../` sequences, the application writes the file content outside the intended project directory to any location writable by the Karavan process. This behavior enables an authenticated user of any role to overwrite application configuration files or files on the application classpath, resulting in remote code execution within the Karavan container. The National Vulnerability Database rates the issue with a CVSS score of 8.8, classifying it as high severity.

Technical Context and Background

The weakness is categorized under CWE-22, which denotes improper limitation of a pathname to a restricted directory. According to the official advisory posted to the oss-security mailing list by Andrea Cosentino on October 9, the issue affects the integrity and availability of the system as well as confidentiality. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates that the attack can be launched remotely with low complexity and requires only low privileges, without user interaction.

This type of path traversal flaw is particularly dangerous in development tools that manage file systems, as it breaks the boundary between managed project files and the underlying host or container filesystem. By manipulating the path segment during the Git commit operation, an attacker can bypass directory restrictions. The ability to write to the application classpath is significant because it allows the injection of malicious code that the application will load and execute, effectively compromising the entire runtime environment.

Who Is Affected

Apache Camel Karavan versions from 3.18.0 up to, but not including, 4.22.1 are affected by this vulnerability. Organizations using these versions of the Apache Camel Karavan tool for designing and managing Camel routes are at risk. The vulnerability requires an authenticated user, meaning that any user with access to the platform, regardless of their specific role, can exploit the flaw. This broadens the attack surface, as even users with minimal permissions can leverage the API to traverse directories and overwrite critical system files.

What should you do?

Users of Apache Camel Karavan are advised to upgrade to version 4.22.1 immediately, as this release contains the fix for CVE-2026-103412. Administrators should verify their current version against the affected range to determine exposure. If immediate upgrading is not possible, organizations should restrict access to the project file API and monitor for unusual file write activities outside the project directory.