oscerd/cve-2026-79985Reproducer and analysis for CVE-2026-79985, a path traversal in Apache Camel camel-smb where share-listing names bypass directory containment, with affected routes and fix details.
Reproducer repository for the Apache Camel vulnerability where the smb consumer builds the remote path of each
polled file by concatenating the configured directory with the name reported in the SMB share listing, with no
containment check. SmbConsumer walks the listing itself (not through RemoteFileConsumer), skipping only the exact
. and .. entries, so a name carrying traversal segments in any other form was concatenated unchecked — resolving
to a path outside the polled directory for retrieval and, with delete/move/preMove/moveFailed/
readLock=rename, deletion or rename.
This reproducer is author-only — see below — and is the SMB sibling of the runnable CVE-2026-79983 (
camel-ftp) and CVE-2026-79984 (camel-mina-sftp), which demonstrate the identical root cause and fix end to end against an embedded malicious server.
As the advisory itself states, reaching the issue over SMB
"requires a server that emits a listing name which is not a single path segment, which a conforming SMB2 implementation does not do; the exposure was corrected on the same basis as the other remote-file consumers rather than from a demonstrated proof of concept against this scheme."
There is no embeddable malicious SMB server that emits such a name (unlike FTP, where Apache MINA FtpServer's VFS can
be made to, and SFTP, where Apache MINA SSHD's getShortName can be overridden). So this repository carries the
exact affected consumer wiring (a real camel-smb route, see SmbRoute.java / SmbRoutes.java) and documents
the mechanism and fix, and defers the runnable end-to-end demonstration to the FTP and SFTP reproducers above.
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.5.13 + camel-smb 4.22.0 (affected; fixed 4.22.1) |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.29.0 + camel-quarkus-smb 3.29.0 (Camel 4.15.0, affected) |
Both modules compile and start cleanly without an SMB server (the route is defined with autoStartup=false). Set
-Dsmb.enabled=true with smb.host/smb.share/smb.username/smb.password to point the exact affected route at
an SMB server of your own.
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack # prints the explanation + links to the runnable PoCs
docker compose down
| Property | Value |
|---|---|
| Component | camel-smb (smb scheme) |
| CWE | CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) |
| Severity | HIGH |
| Attack vector | A share-listing name (server-supplied) that is not a single path segment |
| Impact | Read — and, with delete/move/readLock=rename, delete or rename — files outside the polled directory, using the endpoint's credentials |
| Affected Versions | From 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| Fixed Versions | 4.18.5, 4.22.1, 4.23.0 |
| JIRA | CAMEL-24487 |
| Credit | Dilrevx from NSSL, SJTU |
Advisory: https://camel.apache.org/security/CVE-2026-79985.html
SmbConsumer now applies the same containment check as the other remote-file consumers: a resolved path that falls
outside the polled directory is skipped with a warning, so a listing name carrying traversal segments no longer
reaches the retrieve/delete/rename operand.
Constrain the consumer with filter/antInclude/include to accept only single-segment names, and avoid
delete/move/preMove/moveFailed/readLock=rename against servers whose listings are not fully trusted. Where
possible, confine the server account to the polled directory.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material against systems you do not own or operate.