Apache Camel’s MongoDB GridFS component contains an input‑validation flaw that allows an attacker to override the intended file operation by sending plain gridfs.* HTTP headers. Because the header names do not start with the Camel prefix, the HTTP header filter does not block them, and the values are copied into the Exchange and used by the GridFS producer. The flaw is rooted in CWE‑20 and CWE‑284. A victim can inject a malicious MongoDB query via the gridfs.metadata header (NoSQL operator injection) or change the operation to delete, list, or read files. These actions can remove arbitrary data, enumerate every file in the bucket, or reveal any file’s contents without requiring authentication when the consumer is left unsecured.

Apache Software Foundation’s Apache Camel framework is impacted, specifically the Camel Mongodb‑Gridfs component. Versions from 4.0.0 up to but not including 4.14.8, from 4.15.0 up to but not including 4.18.3, and from 4.19.0 up to but not including 4.21.0 contain the vulnerability. All releases before those patch versions should be upgraded to at least 4.21.0 for general use, or to 4.14.8 / 4.18.3 for the LTS streams.

The CVSS score of 9.8 indicates a critical impact with the potential to cause complete data loss or disclosure. The EPSS score of less than 1% suggests a low current exploitation probability, but the lack of a KEV listing does not diminish the risk. Exploitation requires an HTTP client that can send arbitrary gridfs.* headers to a route exposing the mongodb‑gridfs endpoint with the operation parameter unset and no authentication on the HTTP consumer. Because no credentials are needed when the consumer is unsecured, an attacker can immediately alter the GridFS operation, delete files, enumerate the bucket, or inject NoSQL operators via the metadata header.