The Camel-Azure-Storage-Blob component downloads blobs to the local filesystem by concatenating the configured fileDir with the blob name. Because the component does not normalize the resulting path or enforce that the final location remains inside fileDir, a blob name that contains parent-directory segments can cause the download to write outside the intended directory. This relative path traversal allows an attacker who can control the names of blobs in the container to create or overwrite arbitrary files on the machine running Camel, potentially escalating privileges or affecting system integrity. The flaw is a classic directory traversal weakness, classified as CWE‑23.

The issue is present in all Apache Camel releases from 4.0.0 up to and including 4.14.8, 4.15.0 up to 4.18.3, and 4.19.0 up to 4.21.9. Users running any of these versions with the camel-azure-storage-blob component enabled are vulnerable. The component is part of the larger Apache Camel integration framework, distributed by the Apache Software Foundation. Upstream recommends upgrading to version 4.22.0, or to 4.14.9 for the 4.14.x LTS stream and to 4.18.4 for the 4.18.x stream.

The CVSS score is 9.1, and the EPSS score is <1%, indicating a low probability of exploitation but a severe impact if exploited. The vulnerability is not listed in CISA KEV. Nevertheless, the flaw grants arbitrary local file write, which can lead to privilege escalation or system compromise. Exploitation requires the attacker to influence blob names, which is feasible in publicly writable containers or where the attacker has write access. Since the attack operates locally within the Camel process, the EPSS is low if the container is not exposed, but the potential damage is significant. Immediate attention is advised, especially in environments where Camel processes run with elevated privileges or where the download directory contains sensitive files.