CVE-2026-79985

HIGH CVSS 7.4 PoC Available

Published: 2026-10-19

Modified: 2026-10-20

Enriched via mock

Tenable Plugin

Checking the public Tenable catalog…

AI Threat Summary

CVE-2026-79985 is a high-severity vulnerability with a CVSS score of 7.4 affecting the target software. Threat hunters should monitor for exploit attempts and apply vendor patches immediately.

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not a single path segment therefore resolved to a path outside the configured polling directory, causing Camel to read, delete or rename files outside it using the endpoint's own credentials. A listing name is not route-controlled data. It is supplied by the remote server, and the FTP control channel carries no integrity protection at all, so an on-path attacker can rewrite a LIST response without holding any credentials; a compromised, malicious or multi-tenant server, or a server backed by a virtual filesystem, can emit such a name directly. Retrieval is reachable in a default consumer configuration, since the remote consumers download every listed file; deletion and renaming additionally require one of the disposition options above, all of which are common. Escape from the directory Camel was configured to poll is unconditional, while escape from the server's own account boundary additionally depends on whether that server confines the account. The jailStartingDirectory option, which is documented as restricting Camel to the starting directory and is enabled by default, governed producer writes and, since the localWorkDirectory containment work, consumer downloads to the local work directory - but it did not constrain this remote operand, so its name and description claimed a boundary that was not enforced here. The same entry point had already been recognised on the local side: the localWorkDirectory download path was constrained so that a remote file name containing parent-directory segments could not resolve outside the local work directory. The remote operand was the remaining half of that surface. This artifact provides the smb scheme. Its consumer walks the share listing on its own rather than through RemoteFileConsumer, skipping only the exact "." and ".." entries, so a name carrying traversal segments in any other form was concatenated unchecked. Reaching it requires a server that emits a listing name which is not a single path segment, which a conforming SMB2 implementation does not do; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x releases stream should upgrade to 4.22.1. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. The 4.14.x stream reached end of life and does not receive this fix; users on it should move to a supported releases stream.

Attack Chain

Reconnaissance

Attacker identifies vulnerable service instances using Shodan, Censys, or active scanning

Initial Access

Attacker crafts malicious payload exploiting CVE-2026-79985 to achieve remote code execution

Execution

Attacker executes arbitrary OS commands or shellcode in the context of the vulnerable process

Persistence

Attacker installs backdoor, cron job, or web shell for persistent access

Lateral Movement

Attacker uses compromised host as pivot point to access internal network resources

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application

Initial Access

Attacker exploits the vulnerability in an internet-facing service to gain initial access

T1059 Command and Scripting Interpreter

Execution

Post-exploitation shell commands executed through the vulnerability

T1105 Ingress Tool Transfer

Command and Control

Attacker downloads malware or tools after gaining code execution

Indicators of Compromise

Type	Value	Description
user_agent	`Mozilla/5.0 (compatible; exploit/1.0)`	Generic exploit scanner user agent pattern
url	`/api/vuln-endpoint?payload=<malicious>`	Exploit attempt against application endpoint — monitor access logs for anomalous params
registry_key	`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backdoor`	Persistence mechanism after successful RCE

Remediation

1. Apply vendor-supplied security patches immediately. 2. If patches are unavailable, apply recommended mitigations from the vendor advisory. 3. Enable WAF rules or IDS signatures to detect exploitation attempts. 4. Monitor logs for indicators of compromise listed above. 5. Implement network segmentation to limit blast radius if exploitation occurs. 6. Subscribe to vendor security advisories for this product.

Quick Facts

CVE ID	CVE-2026-79985
CVSS Score	7.4
Vector	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N`
Published	2026-10-19
Exploited	No
CISA KEV	No
PoC	Available

References

External Resources

NVD Entry BleepingComputer The Hacker News