The vulnerability is caused by Camel’s FopProducer creating a javax.xml.transform.TransformerFactory via TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING. On the JDK’s built‑in transformer this setting blocks external DTDs and entities, but when a third‑party JAXP implementation such as Saxon‑HE is present on the classpath, FEATURE_SECURE_PROCESSING alone does not preclude external resource resolution. An attacker can therefore supply an XSL-FO document that contains an external DOCTYPE or entity; the transformer will resolve and expand that reference during the identity transform, allowing the attacker to read files readable by the Camel process and cause outbound requests to arbitrary hosts, leading to information disclosure and possible network reconnaissance.

Apache Camel, available in all releases from 4.14.x through 4.22.x and 4.18.x streams, is affected when a third‑party JAXP TransformerFactory such as Saxon‑HE is present. The 4.23.0 release and the specific patch releases 4.22.1 and 4.18.5 contain a fix. Earlier 4.14.x lines and earlier are end‑of‑life and do not receive a fix. The default JDK transformer is not affected unless overridden by a third‑party factory.

The CVSS score of 6.5 indicates a moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation currently. The likely attack vector requires an attacker to send untrusted XSL-FO to a Camel fop producer while a susceptible JAXP transformer is on the classpath. Successful exploitation results in local file disclosure and the ability to initiate outbound connections. Because the issue is resolved in the 4.23.0 release and later patch releases, the risk can be mitigated by upgrading or applying the specified workarounds.