Apache Camel Karavan EUVD-2026-95756

Requires a valid authenticated Karavan account, but of ANY role (no admin/privileged role needed) - this is the main limiting factor and a low barrier in multi-user deployments. The concrete trigger is a project file submitted through the project file API (create/update/rename/copy endpoints per the patched ProjectFileResource) whose file name (or project ID) contains '../' traversal sequences; the name was used verbatim as a path segment when writing the project to the working copy for a Git commit. No non-default configuration, user interaction, or specific platform is required - the flaw is present in default behavior of affected versions (3.18.0 up to but not including 4.22.1). The write can reach any location writable by the Karavan process, so impact depends on that process's filesystem permissions over its classpath and config.

This is a genuine high-priority issue, not an inflated CVSS score. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) is internally consistent with the description: network-reachable project file API, low attack complexity, and only low privileges needed (the description explicitly says 'an authenticated user of any role'), with full confidentiality/integrity/availability impact because successful exploitation yields code execution in the Karavan container. The signals are coherent rather than conflicting - the only tension is the PR:L requirement, which means an attacker must hold valid credentials, so this is not a fully unauthenticated internet-wide mass-exploitation candidate. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit was identified in the provided data, so there is no public exploit identified at time of analysis. However, a fix commit is public on GitHub, and the root cause (unsanitized file name used verbatim as a path segment, defended by a new PathUtils.resolveInside/validateFileName routine) is simple and clearly visible in the diff, which lowers the effort to reverse-engineer a working exploit. Net: real priority for any organization running affected Karavan versions, especially multi-user deployments where low-privileged accounts exist.

An attacker who holds any authenticated Karavan account (any role) submits a project file through the project file API with a name containing '../' sequences. When Karavan writes the project to its working copy for a Git commit, the traversal escapes the project directory and overwrites a file on the application classpath or a configuration file, leading to code execution inside the Karavan container. No public proof-of-concept was identified at time of analysis, but the fix commit makes the mechanism easy to reconstruct.