AIKIDO-2026-707587
camel-azure-storage-datalake is vulnerable to Path Traversal
55
Medium Risk
This Affects:
camel-azure-storage-datalakeTL;DR
DataLakeFileOperations.downloadToFile builds the local download target by joining fileDir with the remote path name from the Azure SDK and passes that path straight to the download call with no normalization or containment check. The consumer lists Data Lake paths and creates exchanges from those names verbatim, so a name with parent-directory segments resolves outside fileDir and can create or overwrite an arbitrary file the Camel process can write. The fix resolves and normalizes the target under fileDir and rejects paths that escape that directory before downloading.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your routes use the camel-azure-storage-datalake downloadToFile operation against a Data Lake filesystem where an untrusted party can influence object names.
Background info
camel-azure-storage-datalake is vulnerable to Path Traversal in versions 4.0.0 - 4.14.8, 4.15.0 - 4.18.3 and 4.19.0 - 4.21.0.
How to fix this
Upgrade the org.apache.camel:camel-azure-storage-datalake library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant