Apache Camel EUVD-2026-104218

Exploitation requires that the file name in the remote server's directory listing not be a single path segment - i.e. the attacker must influence the LIST/SFTP listing output. Concretely this means one of: a malicious, compromised, or multi-tenant remote server; a server backed by a virtual filesystem that can emit traversal names; or an on-path attacker against plaintext FTP, whose control channel has no integrity protection (SFTP's transport integrity narrows this to server-side control). Read/retrieval is reachable in a DEFAULT consumer configuration since consumers download every listed file; delete requires delete=true, and rename-based escape requires move, preMove, moveFailed, or readLock=rename - all common dispositions. Limiting factors: the jailStartingDirectory option is enabled by default but, prior to the fix, did NOT constrain this remote operand (it governed producer writes and local-work-directory downloads only); escape beyond the configured polling directory is unconditional once a traversal name is accepted, whereas escape beyond the server account's own boundary further depends on whether that server confines the account. The deployer polling only a trusted, dedicated SFTP server over an authenticated host key is substantially less exposed.

This is a genuine but conditional-severity path traversal issue (CWE-22) in Apache Camel's remote-file consumers, including the mina-sftp scheme. The vendor CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) is well-calibrated: network reachable and requiring no attacker credentials (PR:N), but AC:H because successful exploitation depends on the attacker controlling what the remote server reports in a directory listing - either by operating/compromising the SFTP/FTP server, operating in a multi-tenant/virtual-filesystem server, or acting as an on-path attacker who rewrites an unprotected FTP LIST response. There is NO EPSS score, NO CISA KEV listing, and NO public exploit in the provided intelligence, so this is 'no public exploit identified at time of analysis.' That combination - high CVSS driven by C:H/I:H but gated behind a trust-relationship/MITM precondition - means this is a real priority for organizations that poll untrusted, third-party, or multi-tenant remote file servers, but a materially lower practical risk for those polling only trusted, dedicated, integrity-protected (SFTP with a trusted host) endpoints. The absence of KEV/EPSS/POC signals suggests no evidence of active or widespread exploitation yet; prioritize patching where the remote server is outside the deployer's trust boundary.

An organization runs a Camel route whose SFTP/FTP consumer polls a directory on a remote server; an attacker who controls that server (or who is on-path on an unprotected FTP control channel) returns a directory-listing entry such as '../../etc/passwd' instead of a plain filename. Camel concatenates this into the remote path without normalization or containment checks and then retrieves the file (default behavior), or deletes/renames it if delete=true or a move/preMove/moveFailed/readLock=rename disposition is configured, operating outside the polled directory with the endpoint's own credentials. No public exploit code is identified, and successful escape of the server's account boundary additionally depends on whether that server jails the account.