Apache Camel CVE-2026-88901

Exploitation requires that a Camel route unmarshal the XML body using the Smooks data format (.unmarshal().smooks(...)) or the smooks: component with its default reader (Woodstox SAX), and that the attacker can supply or influence the XML message body reaching that route; the affected versions are 4.7.0 before 4.18.5 and 4.19.0 before 4.22.1. No non-default option is needed because external-entity resolution was the default behaviour. LIMITING FACTORS: routes that declare their own reader (EDI, CSV, JSON, or a custom reader) do not use the XML reader and are NOT affected; the marshalling direction is unaffected; and full exfiltration of read file contents or internal responses back to the attacker depends on an InOut (request-reply) route returning the bound result, whereas InOnly routes still permit file read/SSRF side effects but limit direct data return.

This is a genuine priority for any deployment that actually uses the camel-smooks component to unmarshal XML, though the raw CVSS 8.2 overstates the risk for the broader Camel installed base. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) is internally consistent with the description: an external sender who merely controls the XML message body triggers resolution of external entities with no authentication (PR:N) and no user interaction (UI:N), yielding high confidentiality impact (C:H, arbitrary local file read) and low availability impact (A:L, via forced outbound requests / potential resource exhaustion), with no integrity impact (I:N) - a textbook XXE / SSRF profile for CWE-611. The critical caveat is scope: exploitation is network-reachable and default-configuration (no non-default option required, since external-entity resolution was the Woodstox default), BUT only for routes that use the Smooks data format (.unmarshal().smooks(...)) or the smooks: endpoint with the default XML reader - EDI, CSV, JSON and custom-reader configurations are explicitly unaffected, so real-world exposure is narrower than the vector alone implies. No EPSS score was provided, so exploitation probability cannot be quantified. KEV status is absent (not listed) and no POC is referenced, so there is no evidence of active exploitation - the signals point to a credible but not-yet-demonstrated-in-the-wild flaw. Exploitation is confirmed exploitable by the vendor advisory and corroborated by the source patch (addition of a default-off allowExternalEntities option and a hardened DocumentBuilder), which is strong confirmation that the vulnerability and fix are real.

An attacker sends an XML message containing a DOCTYPE with an external subset or an external general entity to a Camel route that unmarshals the body via the Smooks data format or smooks: endpoint; the Woodstox reader resolves the entity, reading a local file (e.g. /etc/passwd or application secrets) or forcing the Camel process to fetch an attacker-named internal URL. On InOut routes the resolved content is bound into the result and returned to the sender, directly exfiltrating file contents or internal service responses. No public exploit is identified at time of analysis, but the technique is a standard, well-understood XXE pattern requiring no special attacker tooling.