CVE-2026-66906 — camel-azure-storage-blob downloadBlobToFile path traversal

Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:

Both are affected versions (the issue is fixed in 4.14.9 / 4.18.4 / 4.22.0), and both demonstrate the identical defect: the camel-azure-storage-blob consumer downloads container blobs to the local filesystem into the directory named by the fileDir option, building the local target as new File(fileDir, client.getBlobName()) — the remote blob name exactly as the Azure SDK reported it, with no normalization and no check that the resolved location stays inside fileDir. The blob name is not route-controlled: the consumer lists the container (BlobConsumer.createBatchExchangesFromContainer) and downloads every blob. A blob whose name contains ../ segments is therefore written outside fileDir (CWE-22, path traversal → arbitrary file write).

Each subdirectory is self-contained (its own Dockerfile, docker-compose.yml bringing up an Azurite emulator, and README). In short, for either:

cd camel-spring-boot   # or: cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down

Expected output on an affected build (both variants):

Files inside the intended download directory /app/downloads:
    - report.txt
File written OUTSIDE it, at /tmp/pwned-66906.txt: true
    content: PWNED via path traversal — CVE-2026-66906
>>> PROVEN: the blob name's ../ segments escaped the configured fileDir directory ... : true

Vulnerability Summary

Advisory: https://camel.apache.org/security/CVE-2026-66906.html

The fix

The consumer now resolves and constrains the download target to the configured fileDir directory (via AzureFileNameHelper.resolveWithinDirectory), rejecting blob names that would escape it. The same fix covers the sibling components camel-azure-storage-datalake (CVE-2026-60093).

Disclaimer

This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The written file is a benign marker under /tmp. Do not use this material against systems you do not own or operate.