org.apache.camel:camel-smb@4.10.2

Affected versions of this package are vulnerable to Directory Traversal via the RemoteFileConsumer in its FTP-family remote-file components. An attacker who can cause a server to report a listing name containing parent-directory segments can make Camel retrieve files outside the configured polling directory, exposing their contents through the endpoint’s credentials; deletion or renaming also becomes possible when the corresponding options are enabled. A malicious or compromised server can supply such names, and an on-path attacker can rewrite FTP listings; retrieval is enabled by default. The SmbConsumer has the same unchecked path construction, but exploiting it requires an SMB server to emit a name that is not a single path segment; conforming SMB2 implementations do not do so, and the advisory reports no demonstrated exploit for that scheme.

Notes

• On the SMB listing-to-path step, exploitation requires the server to emit a name that is not a single path segment; a conforming SMB2 implementation does not do this.
• The escaped remote operation reaches outside Camel’s polling directory, but access beyond the server account’s own boundary depends on whether that account is confined.

Upgrade org.apache.camel:camel-smb to version 4.18.5, 4.22.1 or higher.