The vulnerability arises when the Camel‑PQC FileBasedKeyLifecycleManager deserializes the contents of key files using java.io.ObjectInputStream without any validation or filter. A malicious attacker can place a crafted serialized object in the key directory, and because the readObject() side effects execute before the type check, arbitrary code runs within the application’s process. The effect is the execution of attacker‑supplied code with the same privileges as the running Camel application, allowing compromise of the application and potentially the host system.

Apache Camel PQC versions 4.18.0 through 4.18.1 and 4.19.0 through 4.19.x are affected. The problem is resolved in 4.18.2 and 4.20.0 and later releases.

The CVSS score of 7.8 marks this flaw as high severity, and it falls under CWE‑502 (Insecure Deserialization). The EPSS score of <1% indicates that, as of now, real‑world exploitation is unlikely, and the flaw is not listed in CISA’s KEV catalog. However, the attack vector requires an attacker to write to the key directory—from path traversal, misconfigured filesystem permissions, a compromised provisioning pipeline, or a symlink attack—which is feasible in poorly secured deployments. If such write access is achieved, arbitrary code execution follows immediately during normal key lifecycle operations.