Path traversal in Apache Camel
Priority MEDIUM 44CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 7 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.
Summary
Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
Why it matters now
EPSS 0.08482 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.camel:camel-core (Maven): 2.21.5, 2.22.3, 2.23.1Red Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Camel | Camel 2.21.0 to 2.21.3; Camel 2.22.0 to 2.22.2 and Camel 2.23.0 The unsupported Camel 2.x (2.19 and earlier) versions may be also affected. | — | No fix listed | CNA |
| — | org.apache.camel:camel-core (Maven) | 2.21.0 to before 2.21.5 | 2.21.5 | Patch available | GHSA-4wjq-69rc-8wcp |
| — | org.apache.camel:camel-core (Maven) | 2.22.0 to before 2.22.3 | 2.22.3 | Patch available | GHSA-4wjq-69rc-8wcp |
| — | org.apache.camel:camel-core (Maven) | 2.23.0 to before 2.23.1 | 2.23.1 | Patch available | GHSA-4wjq-69rc-8wcp |
- Apache Camel VendorApache Affected Camel 2.21.0 to 2.21.3; Camel 2.22.0 to 2.22.2 and Camel 2.23.0 The unsupported Camel 2.x (2.19 and earlier) versions may be also affected. Fixed in — No fix listed CNA
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.21.0 to before 2.21.5 Fixed in 2.21.5 Patch available GHSA-4wjq-69rc-8wcp
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.22.0 to before 2.22.3 Fixed in 2.22.3 Patch available GHSA-4wjq-69rc-8wcp
- org.apache.camel:camel-core (Maven) Vendor— Affected 2.23.0 to before 2.23.1 Fixed in 2.23.1 Patch available GHSA-4wjq-69rc-8wcp
Remediation
- Fix · GHSA-4wjq-69rc-8wcp org.apache.camel:camel-core (Maven) Fixed in 2.21.5 Advisory →
- Fix · GHSA-4wjq-69rc-8wcp org.apache.camel:camel-core (Maven) Fixed in 2.22.3 Advisory →
- Fix · GHSA-4wjq-69rc-8wcp org.apache.camel:camel-core (Maven) Fixed in 2.23.1 Advisory →
Red Hat 1 advisory
- RHSA-2019:0910 Released 2019-04-30 · Red Hat rating ImportantRed Hat Fuse 7.3 security update
- Red Hat Fuse 7.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss BRMS 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.3 | Fixed | RHSA-2019:0910 |
Not affected: 1 product
- Red Hat JBoss Data Grid 7
Timeline
- 2026-10-02 Threatist record created from CVE-2019-0194
- 2026-10-03 Alias added: GHSA-4wjq-69rc-8wcp
- 2026-10-21 EPSS moved to the 95th–99th percentile
- 2026-10-25 EPSS moved to the 90th–95th percentile
- 2026-10-28 EPSS moved to the 95th–99th percentile
References
Exploit 1
Other 14
- [camel-commits] 20190430 [camel] branch master updated: Added CVE-2019-0194 details
- [camel-users] 20190430 [SECURITY] New security advisory CVE-2019-0194 released for Apache Camel
- [camel-commits] 20190430 svn commit: r1044347 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0194.txt.asc security-advisories.html
- https://lists.apache.org/thread.html/a39441db574ee996f829344491b3211b53c9ed926f00ae5d88943b76%40%3Cdev.camel.apache.org%3E
- [camel-commits] 20190524 [camel] branch master updated: Added security advisory for CVE-2019-0188
- [camel-commits] 20190524 [camel] 02/02: CVE-2019-0188 - Changed the title in security advisories
- [camel-commits] 20190524 svn commit: r1045395 - in /websites/production/camel/content: cache/main.pageCache security-advisories.data/CVE-2019-0188.txt.asc security-advisories.html
- https://github.com/apache/camel/pull/2700
- https://github.com/apache/camel
- https://issues.apache.org/jira/browse/CAMEL-13042
- https://lists.apache.org/thread.html/0a163d02169d3d361150e8183df4af33f1a3d8a419b2937ac8e6c66f@%3Cusers.camel.apache.org%3E
- https://lists.apache.org/thread.html/45e23ade8d3cb754615f95975e89e8dc73c59eeac914f07d53acbac6@%3Ccommits.camel.apache.org%3E
- https://lists.apache.org/thread.html/a39441db574ee996f829344491b3211b53c9ed926f00ae5d88943b76@%3Cdev.camel.apache.org%3E
- https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E
More Apache Camel vulnerabilities
- TI-2026-76322 Unsafe deserialization in Apache Camel camel-hazelcast CVSS 4.0CRITICAL 10.0
- TI-2026-18973 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy CVSS 3.1CRITICAL 9.1
- TI-2026-76339 Path traversal in Apache Camel azure-files component CVSS 3.1CRITICAL 9.1
- TI-2026-76330 Path traversal in Apache Camel FTP consumer escapes polled directory CVSS 3.1CRITICAL 9.1
- TI-2025-20435 Apache Camel: Camel Message Header Injection via Improper Filtering CVSS 3.1MEDIUM 5.6
- TI-2026-34899 Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-0194 · CVE Program
- CVE-2019-0194 · NVD
- FIRST EPSS
- GHSA-4wjq-69rc-8wcp · GitHub Advisory Database · CC BY 4.0
- CVE-2019-0194 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences