The vulnerability occurs in the Smooks component of Apache Camel when it parses incoming XML using its default Woodstox SAX parser, which automatically resolves external general and parameter entities and loads external DTDs. An attacker can embed a DOCTYPE or external entity declaration in the XML payload to cause the Camel process to read arbitrary local files or send requests to internal network hosts. The files that can be read are those accessible by the Camel runtime and the injected content is returned in InOut routes, exposing sensitive data or providing a foothold for further attacks.

Versions 4.7.0 through 4.18.4, 4.19.0 through 4.22.0 of Apache Camel are affected. Users on the 4.18.x LTS stream should move to 4.18.5, on the 4.22.x LTS stream to 4.22.1, and all users should upgrade to 4.23.0 or newer. The 4.14.x and earlier releases are out of support and require moving to a supported release line.

The CVSS score of 8.2 indicates high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an untrusted sender transmitting XML that is processed by the Smooks data format or SMooks endpoint without any remediation in place. The lack of a available EPSS score suggests no published exploitation data yet, but the high CVSS and the ability to read local files or trigger internal traffic make the risk significant. The default behavior of the vulnerable parser implies that no special configuration changes are needed by an attacker – simply sending crafted XML to a Smooks endpoint would be sufficient.