Camel AWS2-S3 treats untrusted keys as expressions (CVE-2026-95664)
Original title: CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
A low-privileged attacker can inject expressions through the CamelAwsS3Key header; the CVSS score is 5.4.
Andrea Cosentino disclosed an expression-language injection flaw in the Apache Camel AWS2-S3 producer. Untrusted S3 object keys supplied in the CamelAwsS3Key header are evaluated as Simple expressions. Affected releases are camel-aws2-s3 from 4.8.0 before 4.18.5 and from 4.19.0 before 4.22.2. The notice is truncated and does not mention exploitation.
Unconfirmed: The description is cut off, so the full injection conditions are not stated.
- CVSS 3.1 is 5.4, with low confidentiality and integrity impact and no availability impact.
- The vector requires network access and low privileges, but no user interaction.
- The affected artifact is org.apache.camel:camel-aws2-s3.
Impact: Low-privilege expression injection via untrusted S3 object keys
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-aws2-s3 | 4.8.0 before 4.18.5; 4.19.0 before 4.22.2 | 4.18.5, 4.22.2 |
- 1.Upgrade org.apache.camel:camel-aws2-s3 to 4.18.5 or 4.22.2.
- CVEs
- CVE-2026-95664
- Vendors
- Apache
- Products
- Apache Camelcamel-aws2-s3
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95664 | Expression Language Injection in Apache Camel AWS2-s3 | 5.4 | — |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 5. 4 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.