Upgrade Apache Camel Karavan to 4.22.1 Immediately to Mitigate Critical RCE via Path Traversal

Security teams must upgrade Apache Camel Karavan to version 4.22.1 immediately to mitigate CVE-2026-103412. This high-severity path traversal vulnerability allows authenticated users to execute remote code by manipulating project file names during Git commit operations. The flaw exists in versions 3.18.0 through 4.22.0 of the software.

What is CVE-2026-103412?

CVE-2026-103412 is a path traversal vulnerability identified in Apache Camel Karavan. According to the National Vulnerability Database, it is rated 8.8 High severity. The issue stems from improper limitation of a pathname to a restricted directory. Specifically, the project file API uses supplied file names verbatim as path segments when writing projects to a Git working copy.

How does the exploit work?

An attacker who has authenticated access to the Karavan application can supply a project file name containing `../` sequences. When the system writes this file to the working copy for a Git commit, it accepts the sequence as a valid path segment. This causes the file content to be written outside the intended project directory to any location writable by the Karavan process.

What are the potential impacts?

Successful exploitation allows an authenticated user of any role to overwrite critical system files. Attackers can target application configuration files or files on the application classpath. According to the oss-security advisory posted by Andrea Cosentino on October 9, this capability enables the execution of arbitrary code within the Karavan container, compromising the entire application environment.

Which versions are affected?

The vulnerability affects Apache Camel Karavan starting from version 3.18.0 up to, but not including, version 4.22.1. Any installation running these versions is considered vulnerable. The Apache Software Foundation confirmed that version 4.22.1 includes the necessary fix to address the improper pathname limitation. Users on affected versions are urged to upgrade without delay.

What to do and how to stay safe: Apache Camel Karavan

• Verify your current Apache Camel Karavan version against the affected range of 3.18.0 to 4.22.0 and plan an immediate upgrade to 4.22.1.
• Monitor application logs for unusual file creation or modification events, particularly those involving path traversal sequences like `../` in file names.
• Restrict access to the Karavan project file API by enforcing strict role-based access controls and limiting which users can initiate Git commits.
• Review file system permissions for the Karavan process to ensure it has the minimum necessary write access, reducing the impact of any potential path traversal attempts.

Step-by-step guide: Emergency Patching: The High Cost of Fixing Critical Flaws Fast

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-103412 a remote code execution vulnerability?

Yes, the path traversal flaw allows authenticated users to overwrite files on the classpath, leading to remote code execution within the Karavan container.

Does this vulnerability require authentication to exploit?

Yes, an attacker must have an authenticated user account in Apache Camel Karavan to exploit CVE-2026-103412, though any role is sufficient.

When was CVE-2026-103412 disclosed?

The advisory was posted to the oss-security mailing list on October 9, 2026, by Andrea Cosentino, detailing the high-severity path traversal issue.