Apache Camel EUVD-2026-104191

Requires that the Camel XPath expression be explicitly configured with documentType=InputSource (via .documentType(InputSource.class)) AND that it evaluates XML originating from an untrusted/external sender; under this configuration the payload was handed straight to javax.xml.xpath, which built its own DocumentBuilder using JDK defaults that accept a DOCTYPE and resolve external entities. The key LIMITING factor is that this is NOT the default - Camel's default document type is hardened and refuses the DOCTYPE, so default deployments are not exploitable. A further residual condition: even after upgrading, deployments that have set the DocumentBuilderFactory system properties that relax the default type's escape hatch remain unprotected by design. Affected versions are 4.0.0 before 4.18.5 and 4.19.0 before 4.22.1; no user interaction or authentication is required once the vulnerable configuration is present.

This is a genuine but conditionally-gated XXE (CWE-611) in Apache Camel's XPath component, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The network, no-auth, no-UI vector is credible because an external sender's XML can reach a vulnerable XPath expression, and confirmed impact is high-confidentiality file disclosure plus SSRF (the process issuing requests to attacker-named hosts). However, the CVSS base vector does NOT capture the single most important limiting factor: exploitation only works when a deployment has explicitly set documentType=InputSource on an expression evaluated over untrusted XML - the default document type already refuses the DOCTYPE and is not vulnerable. No EPSS score, CISA KEV listing, or POC were provided in the input; a vendor functional test demonstrating the file-read canary exists in the patch but is not a weaponized public exploit. Net: this is a real, patch-worthy issue for the subset of Camel deployments using the InputSource document type over external XML, but it is not a drop-everything mass-exploitation threat - absent KEV/EPSS/POC signals and given the non-default configuration precondition, treat it as a targeted-risk, prioritized-patching item rather than a widespread active threat. EPSS/KEV data is MISSING and should be checked before final prioritization.

A Camel route exposes an endpoint whose XPath expression is configured with documentType=InputSource and evaluates XML arriving from an external sender. The attacker submits XML containing a DOCTYPE with an external entity (e.g. a SYSTEM reference to a local file or an internal URL); because InputSource bypassed Camel's hardened parser and used JDK defaults, the entity is resolved and expanded, letting the attacker read files readable by the Camel process or force server-side requests (SSRF) to hosts they name. No public exploit was identified at time of analysis, though the vendor patch ships a proof-of-concept test using a file-read canary.