oscerd/cve-2026-79984Runnable proof-of-concept reproducer for CVE-2026-79984, a path traversal in Apache Camel camel-mina-sftp, with malicious SFTP server fixtures and affected vs. fixed builds.
Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the mina-sftp consumer — which
derives from the same RemoteFileConsumer base class as the other remote-file consumers — builds the absolute
remote path of each polled file by concatenating the configured directory with the name reported in the server's
directory listing, with no lexical normalization and no containment check. That path then becomes the operand for
retrieval (always), and for deletion or rename when delete=true, move, preMove, moveFailed or
readLock=rename is configured.
An SFTP directory-entry name is a raw protocol string supplied by the server, so a compromised, malicious or multi-tenant server can report a name that is not a single path segment.
This is the
mina-sftpsibling of CVE-2026-79983 (camel-ftp); both share the same root cause and the same fix.
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.5.13 + camel-mina-sftp 4.22.0 (affected; fixed 4.22.1) |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.39.0 + camel-quarkus-mina-sftp 3.39.0 (Camel 4.22.0, affected; fixed control 3.40.0 / Camel 4.22.1) |
camel-mina-sftpwas introduced in Camel 4.18.0, so the component does not exist in the Camel 4.15.0 bundled by the latest-numbered Camel Quarkus; this reproducer uses Camel Quarkus 3.39.0 (Camel 4.22.0, affected), with 3.40.0 (Camel 4.22.1) as the patched control. Both modules therefore demonstrate the affected and the fixed behaviour.
The app embeds a deliberately malicious SFTP server (Apache MINA SSHD). It serves a real temporary directory
tree but rewrites, in its SSH_FXP_READDIR reply, the name of one file in the polled directory /upload to the
traversal string d/../../outside.txt (via a getShortName override). The name does not start with a dot, so
Camel's hidden-file rule does not catch it, and /upload + d/../../outside.txt resolves to /outside.txt, one
level above the polled directory. A plain mina-sftp consumer polls /upload.
normal.txt and the escaping /outside.txt.normal.txt and skips the escaping entry, logging
Skipping file as it resolves outside the starting directory: upload/d/../../outside.txt.cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack
docker compose down
Expected output on the affected build:
name=[d/../../outside.txt] <<< FILE FROM OUTSIDE THE POLLED DIRECTORY
content: OUTSIDE-SECRET (/outside.txt, a file the consumer should never reach)
name=[normal.txt] (inside)
| Property | Value |
|---|---|
| Component | camel-mina-sftp (mina-sftp scheme) |
| CWE | CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) |
| Severity | HIGH |
| Attack vector | A READDIR entry name (server-supplied) that is not a single path segment |
| Impact | Read — and, with delete/move/readLock=rename, delete or rename — files outside the polled directory, using the endpoint's credentials |
| Affected Versions | From 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| Fixed Versions | 4.18.5, 4.22.1, 4.23.0 |
| JIRA | CAMEL-24487 |
| Credit | Dilrevx from NSSL, SJTU |
Advisory: https://camel.apache.org/security/CVE-2026-79984.html
GenericFileConsumer.isWithinStartingDirectory (overridden by RemoteFileConsumer, from which the mina-sftp
consumer derives) compacts the resolved path and verifies, on path-segment boundaries, that it stays inside the
polled directory; an entry resolving outside is skipped with a warning while the legitimate entries still process.
Verify the server host key, constrain the consumer with filter/antInclude/include to accept only single-segment
names, and avoid delete/move/preMove/moveFailed/readLock=rename against servers whose listings are not
fully trusted. Where possible, confine the server account to the polled directory.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The malicious server and the "secret" are inert local fixtures. Do not use this material against systems you do not own or operate.