Can Git commits let attackers execute code via CVE-2026-103412 in Apache Camel Karavan?
A high-severity flaw in Apache Camel Karavan lets authenticated users write files outside project directories, enabling remote code execution via Git commits.
Key points
- CVE-2026-103412 affects Apache Camel Karavan versions 3.18.0 through 4.22.0.
- The vulnerability allows path traversal when committing projects to Git via the API.
- Attackers can overwrite configuration files to execute arbitrary code in the container.
The short version
- Apache Camel Karavan contains a path traversal flaw rated CVSS 8.8 high severity.
- Authenticated users can exploit the project file API to write data outside intended directories.
- Version 4.22.1 resolves the issue by sanitising file names during Git commit operations.
The details
The vulnerability, identified as CVE-2026-103412, stems from improper limitation of pathnames within Apache Camel Karavan. According to the National Vulnerability Database, the flaw is classified under CWE-22. When a user supplies a project file name through the project file API, the application uses that name verbatim as a path segment.
This occurs specifically when the project is written to the working copy for a Git commit. If the supplied name contains `../` sequences, the application writes the file content outside the restricted project directory. The destination can be any location writable by the Karavan process itself. This behaviour allows an attacker to escape the intended sandbox and modify sensitive system files.
The context
An authenticated user of any role can exploit this issue. According to the oss-security mailing list advisory posted on 9 October, the flaw enables remote code execution. By overwriting application configuration files or files on the application classpath, an attacker can inject and execute arbitrary code within the Karavan container. The advisory highlights that the impact includes high confidentiality, integrity and availability metrics. The affected versions range from 3.18.0 up to, but not including, 4.22.1. This wide range means many deployments may still be vulnerable if they have not recently updated their integration tooling.
Next steps
Users running Apache Camel Karavan must upgrade to version 4.22.1. This release fixes the path traversal issue by ensuring file names are properly validated before being used in Git operations. Administrators should audit their current installations to confirm they are not running versions prior to 4.22.1. The Apache Software Foundation has confirmed that the fix is available in the latest stable release. Delaying the upgrade leaves the system exposed to potential remote code execution attacks by any authenticated user.
What to do and how to stay safe: Apache Camel Karavan
- Verify the installed version of Apache Camel Karavan against the affected range of 3.18.0 to 4.22.0.
- Upgrade to version 4.22.1 immediately to apply the vendor-provided fix for the path traversal flaw.
- Monitor Git commit logs and file system changes for unexpected writes outside project directories.
- Review access controls for the project file API to limit exposure while upgrades are pending.
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apache Camel Karavan are affected by CVE-2026-103412?
Versions from 3.18.0 before 4.22.1 are affected by this path traversal vulnerability.
What is the severity rating for this vulnerability?
The CVSS 3.1 score is 8.8, which is rated as high severity.
How can an attacker exploit this flaw?
An authenticated user can supply a file name with `../` sequences via the API to write files outside the project directory.
