Apache Camel CVE-2026-60093

The attacker must have write access to the specific Azure Data Lake Storage Gen2 filesystem that the Camel consumer is configured to enumerate - this is the critical prerequisite that narrows the exposed population. The Camel route must be using the camel-azure-storage-datalake component with the downloadToFile operation enabled; routes that do not invoke downloadToFile are not affected. The consumer must be actively running and polling the filesystem. No special non-default configuration is required to be vulnerable: the fileDir option is a standard common-group parameter carrying no security marker, and the traversal occurs in the default consumer enumeration path. Exploitation is limited by: (1) the requirement for Data Lake write access - environments where the storage account is exclusively controlled by the Camel operator are not exploitable by external parties; (2) the impact ceiling being bounded by the filesystem privileges of the Camel process - a minimal service account with restricted write scope significantly reduces the blast radius; (3) no network-level unauthenticated vector - the attack requires cloud storage credentials or permissions.

No CVSS vector was provided by NVD or the reporter at time of analysis - metrics below are independently assessed. The exploitability profile is moderate: the attacker must have write access to the Azure Data Lake filesystem that Camel is consuming, which is a non-trivial prerequisite that limits the exposed population. However, once that access exists, exploitation is straightforward and requires no interaction from a Camel operator - the consumer automatically enumerates and downloads all listed paths. The integrity impact is high: the Camel process can be made to write or overwrite any file it has permission to write, potentially including configuration files, cron jobs, SSH authorized_keys, or application binaries, enabling privilege escalation beyond the immediate integrity loss. No EPSS score is available; no KEV listing exists; no public POC has been identified. The practical risk is highest for Camel deployments in multi-tenant or shared Azure environments where the Data Lake storage account is not exclusively controlled by the Camel operator, or in deployments where the Camel process runs with elevated filesystem privileges. For deployments where the Data Lake account is tightly access-controlled and the Camel process runs under a restricted service account, real-world risk is substantially lower than the worst-case CVSS suggests.

An attacker with write access to the Azure Data Lake Storage Gen2 filesystem that a Camel route is consuming creates a file whose name contains a parent-directory traversal sequence, such as '../../etc/cron.d/backdoor'. When the Camel consumer next polls the filesystem, it enumerates this path and, without any name filtering or normalization, invokes downloadToFile with the resolved path /configured/fileDir/../../etc/cron.d/backdoor. The Camel process writes the attacker-controlled file content to /etc/cron.d/backdoor, establishing a cron-based persistence mechanism with the privileges of the Camel service account. No public POC has been identified, but the attack is straightforward given write access to the storage account.