The Camel Azure-Storage Datalake component builds the download target by concatenating the configured fileDir with the remote file path exactly as returned by the Azure SDK, without normalizing or validating that the resulting path remains inside the intended directory. The lack of containment checks allows an attacker who can influence the names that appear in the Azure Data Lake filesystem—such as by uploading files with names containing '..' or directory separators—to cause Camel to create or overwrite a file at an arbitrary location on the local machine, with the privileges of the Camel process.

Apache Camel 4.0.0 through 4.14.8, 4.15.0 through 4.18.3, and 4.19.0 through 4.21.x are vulnerable. The issue is fixed in 4.22.0, and the LTS streams were patched in 4.14.9 and 4.18.4.

The vulnerability is a classic path-traversal flaw (CWE-23). Exploitation depends on the ability to supply a malicious file name that the component enumerates, which can be achieved by uploading or renaming files in the Data Lake storage under the consumer's account. Once such a name is present, the consumer builds an exchange, downloads the file to the crafted path, and writes the payload without boundary checks. The EPSS score is < 1%, indicating a low probability of exploitation in the wild, and the CVSS score of 5.5 reflects moderate risk. The local file overwrite can lead to loss of integrity and, if the Camel process runs with elevated privileges, privilege escalation. The CVE is not listed in CISA's KEV catalog.