Apache Camel Karavan: Path traversal via project file names when committing to Git
Summary
Apache Camel Karavan uses project file names received through the project file API as path segments when writing projects to the Git working copy. A file name containing '../' sequences writes file content outside the project directory, to any location writable by the Karavan process. An authenticated user of any role can overwrite application configuration or classpath files and thereby execute code in the Karavan container.
Affected
- Apache Camel Karavan from 3.18.0 before 4.22.1
Fixed in
- Apache Camel Karavan 4.22.1 (the only release containing the fix; no maintenance branches)
Workaround
Unknown.
Exploitation
- No confirmed exploitation reported at the time of writing.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.00515 (low).
Our recommendation
- Identify all Karavan instances and their versions; versions 3.18.0 to before 4.22.1 are affected.
- Upgrade to Apache Camel Karavan 4.22.1 and apply the fix for CVE-2026-103413 in the same change.
- Until patched, restrict access to the Karavan UI and API to required users and networks, and review user accounts, including shared accounts.
- Check Karavan containers and Git working copies for unexpected files outside project directories and for unexpected changes to configuration or classpath files.
- Monitor for further reports of exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Apache Camel security advisory CVE-2026-103412 camel.apache.org
- Fix commit 5e42524 in apache/camel-karavan github.com
- OpenWall oss-security post www.openwall.com
- OSV record CVE-2026-103412 osv.dev
- Apache Camel website pull request 1805 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:55.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing `../` sequences caused the file content to be written outside the project directory, to any location writable by the Karavan process. An authenticated user of any role could use this to overwrite application configuration or files on the application classpath and so execute code in the Karavan container. This issue affects Apache Camel Karavan: from 3.18.0 before 4.22.1. Users are recommended to upgrade to version 4.22.1, which fixes the issue.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.