The vulnerability is an improper input validation flaw in the Camel Tika component, where parsed document metadata is mapped directly to Exchange headers without filtering. An attacker can craft a document embedding arbitrary header keys, such as CamelFileName, allowing the route to rewrite critical routing parameters and direct output to unintended locations. This header injection can potentially lead to file system modification or other unintended behavior, impacting confidentiality, integrity, or availability of the system.

Apache Camel from version 4.0.0 up to but not including 4.18.5, and from 4.19.0 up to but not including 4.22.1. The 4.18.x LTS stream is addressed by upgrading to 4.18.5, while the 4.22.x LTS stream is addressed by upgrading to 4.22.1. Versions 4.23.0 and later contain the fix with filtered metadata handling.

The CVSS score of 6.5 indicates a moderate impact, and the EPSS score is not available, suggesting no current evidence of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack requires the ability to supply a document to the Tika producer; no explicit network boundary is necessary, but the threat vector is local or application-level injection via file ingestion. If exploited, an attacker could manipulate routing decisions to write data to arbitrary paths or override application logic.