Apache Camel EUVD-2026-104208

Exploitation requires that an alternative (non-JDK) JAXP TransformerFactory implementation be present on the application classpath - specifically Saxon-HE, typically introduced by also using camel-xslt-saxon or camel-saxon - because only such a factory ignores external-resource limits under FEATURE_SECURE_PROCESSING. The attacker must also be able to deliver an XSL-FO document (with a DOCTYPE external subset or external general entity) to a Camel route that feeds a fop producer. Key LIMITING factors: a default camel-fop deployment using the JDK transformer (which empties the accessExternalDTD/accessExternalStylesheet limits and excludes Xalan) is NOT vulnerable, so this is reachable only in non-default classpath configurations; file read is bounded to files readable by the Camel process. Releases on the 4.14.x line and earlier are EOL and receive no fix, so only migration to a fixed supported line remediates them.

This is a genuine but conditional information-disclosure flaw (CWE-611 XXE) in Apache Camel's camel-fop component, not a top-priority internet-wide emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N, base 6.5 Medium) shows the signals pull in opposite directions: network-reachable and unauthenticated (AV:N/PR:N/UI:N) raises concern, but AC:H correctly reflects that exploitation is gated on a non-default precondition - an alternative JAXP TransformerFactory (e.g., Saxon-HE, pulled in by camel-xslt-saxon or camel-saxon) being present on the classpath. A default camel-fop deployment uses the JDK transformer (which empties accessExternalDTD/accessExternalStylesheet under FEATURE_SECURE_PROCESSING) and excludes Xalan, so it is NOT affected. No EPSS score, no CISA KEV entry, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The impact when conditions are met is real - arbitrary file read (C:H) and server-side request forgery (I:L) - but the narrow, operator-dependent trigger means this is best treated as a 'patch in normal cycle, audit classpath' item rather than an immediate drop-everything issue.

An external sender submits a crafted XSL-FO document (containing a DOCTYPE with an external subset or an external general entity) to a Camel route whose fop producer renders it to PDF, in a deployment that also has Saxon-HE on the classpath. The Saxon TransformerFactory resolves the external entity during the identity transform, letting the attacker exfiltrate local files readable by the Camel process or force the process to make requests to attacker-named hosts (SSRF). No public exploit code was provided, and the attack only works outside the default, JDK-transformer configuration.