CVE-2026-60093 — camel-azure-storage-datalake downloadToFile path traversal

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (the issue is fixed in 4.14.9 / 4.18.4 / 4.22.0), and both demonstrate the identical defect: the camel-azure-storage-datalake component can download an ADLS Gen2 file to the local filesystem through its downloadToFile operation, writing into the directory named by the fileDir option. DataLakeFileOperations.downloadToFile built the local target by joining fileDir with the remote path name exactly as the Azure SDK reported it (new File(fileDir, fileClientWrapper.getFileName())) — with no lexical normalization and no check that the resolved location stayed inside fileDir. The remote name is not route-controlled: the consumer enumerates the filesystem (DataLakeConsumer.createBatchExchangesFromPath) and downloads every entry. A path name containing ../ segments therefore resolves outside fileDir (CWE-22, path traversal → arbitrary file write).

Note on the test harness. The Azure Data Lake Gen2 API is not implemented by any available local emulator — Azurite returns HTTP 400 for Gen2 listPaths and file operations. These reproducers therefore drive the exact vulnerable code (DataLakeFileOperations.downloadToFile → new File(fileDir, fileClientWrapper.getFileName())) directly, supplying a Data Lake file client wrapper whose getFileName() returns the remote name — exactly as the consumer supplies the name it read from PathItem.getName(). The sibling component camel-azure-storage-blob shares the same fix (CVE-2026-66906) and there the identical defect is reproduced end-to-end against a live Azurite emulator.

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Expected output on an affected build (both variants):

2) Download of a file named '../../../../../../tmp/pwned-60093.txt':
     resolved local target: /app/downloads/../../../../../../tmp/pwned-60093.txt
File written OUTSIDE it, at /tmp/pwned-60093.txt: true
    content: PWNED via path traversal — CVE-2026-60093
>>> PROVEN: DataLakeFileOperations.downloadToFile built the local target as new File(fileDir, fileName) ... : true

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-60093.html

The fix

The consumer now resolves and constrains the download target to the configured fileDir directory (via AzureFileNameHelper.resolveWithinDirectory), rejecting path names that would escape it — the same fix that covers camel-azure-storage-blob (CVE-2026-66906).

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The written file is a benign marker under /tmp. Do not use this material against systems you do not own or operate.