Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in…
Priority LOW 33Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Partial Red Hat: 5 fixed, 2 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Why it matters now
EPSS 0.07098 94th percentileScored 2026-11-07
Fix Partial org.apache.camel:camel-core (Maven): 2.13.4, 2.14.2Red Hat: 4 advisoriesRed Hat: 5 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.camel:camel-core (Maven) | before 2.13.4 | 2.13.4 | Patch available | GHSA-mhx2-r3jx-g94c |
| — | org.apache.camel:camel-core (Maven) | 2.14.0 to before 2.14.2 | 2.14.2 | Patch available | GHSA-mhx2-r3jx-g94c |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.camel:camel-core (Maven) Vendor— Affected before 2.13.4 Fixed in 2.13.4 Patch available GHSA-mhx2-r3jx-g94c
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.14.0 to before 2.14.2 Fixed in 2.14.2 Patch available GHSA-mhx2-r3jx-g94c
Remediation
- Fix · GHSA-mhx2-r3jx-g94c org.apache.camel:camel-core (Maven) Fixed in 2.13.4 Advisory →
- Fix · GHSA-mhx2-r3jx-g94c org.apache.camel:camel-core (Maven) Fixed in 2.14.2 Advisory →
Red Hat 4 advisories
- RHSA-2015:2558 Released 2015-12-07 · Red Hat rating ImportantRed Hat JBoss Fuse Service Works 6.2.1 update
- Red Hat JBoss Fuse Service Works 6.2
- RHSA-2015:1538 Released 2015-08-03 · Red Hat rating ModerateRed Hat JBoss BRMS 6.1.2 update
- Red Hat JBoss BRMS 6.0
- RHSA-2015:1539 Released 2015-08-03 · Red Hat rating ModerateRed Hat JBoss BPM Suite 6.1.2 update
- Red Hat JBoss BPMS 6.0
Show 1 more Red Hat advisories
- RHSA-2015:1041 Released 2015-06-01 · Red Hat rating ModerateRed Hat JBoss Fuse/A-MQ 6.1.0 update
- Red Hat JBoss A-MQ 6.1
- Red Hat JBoss Fuse 6.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Enterprise 1 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Enterprise 2 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6.1 | Fixed | RHSA-2015:1041 |
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2015:1539 |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2015:1538 |
| Red Hat JBoss Fuse 6.1 | Fixed | RHSA-2015:1041 |
| Red Hat JBoss Fuse Service Works 6.2 | Fixed | RHSA-2015:2558 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-0264
- 2026-10-03 Alias added: GHSA-mhx2-r3jx-g94c
References
Advisory 6
Other 10
- https://git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=1df559649a96a1ca0368373387e542f46e4820da
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/commit/7360aada5154434c68774aa30e0f21ddc5f27b9f
- https://github.com/apache/camel/commit/b47b51a195b38e7ab7c099d19910af70a16638f6
- https://git-wip-us.apache.org/repos/asf?p=camel.git;a=commitdiff;h=1df559649a96a1ca0368373387e542f46e4820da
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-8312
- https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2015-0264 · CVE Program
- CVE-2015-0264 · NVD
- FIRST EPSS
- GHSA-mhx2-r3jx-g94c · GitHub Advisory Database · CC BY 4.0
- CVE-2015-0264 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences