Vulnerabilityhigh
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git
AI summary · grok-4.7Summaries by Vani AI
Apache Camel Karavan before 4.22.1 has high-severity path traversal CVE-2026-103412 via project file names written to Git.
Apache disclosed CVE-2026-103412, a path traversal flaw in Apache Camel Karavan scored CVSS 3.1 8.8. Versions from 3.18.0 before 4.22.1 are affected. A project file name supplied through the project file API was used verbatim as a path segment when the project was written into the Git working copy. The advisory does not report exploitation in the wild.
Key facts
- CVE-2026-103412 is rated CVSS 3.1 8.8 high.
- Affects Apache Camel Karavan 3.18.0 before 4.22.1.
- Unsanitized project file names are used as Git paths.
- Attacker needs low privileges and no user interaction.
- Advisory does not report active exploitation.
- CVEs
- CVE-2026-103412
- Vendors
- Apache Software Foundation
- Products
- Apache Camel Karavan
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103412 | Path traversal code execution in Apache Camel Karavan | 8.8 | — |
From the original article
Posted by Andrea Cosentino on Oct 09 Severity: CVSS 3. 1: 8. 8 (high) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.