Exploit for CVE-2026

# CVE-2026-79984 — camel-mina-sftp: consumer builds the remote path from the server's listing without containment

Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the `mina-sftp` consumer — which

derives from the **same `RemoteFileConsumer` base class** as the other remote-file consumers — builds the absolute

remote path of each polled file by concatenating the configured directory with the name reported in the server's

directory listing, with no lexical normalization and no containment check. That path then becomes the operand for

retrieval (always), and for deletion or rename when `delete=true`, `move`, `preMove`, `moveFailed` or

An SFTP directory-entry name is a raw protocol string supplied by the server, so a compromised, malicious or

multi-tenant server can report a name that is not a single path segment.

> This is the `mina-sftp` sibling of [CVE-2026-79983]( (`camel-ftp`); both

> the same root cause and the same fix.

| **Camel Spring Boot** | [`camel-spring-boot/`](camel-spring-boot/) | Spring Boot 3.5.13 + camel-mina-sftp **4.22.0** (affected; fixed 4.22.1) |

| **Camel Quarkus** | [`camel-quarkus/`](camel-quarkus/) | Quarkus 3.39.0 + camel-quarkus-mina-sftp **3.39.0** (Camel **4.22.0**, affected; fixed control 3.40.0 / Camel 4.22.1) |

> `camel-mina-sftp` was introduced in Camel **4.18.0**, so the component does not exist in the Camel 4.15.0 bundled

> by the latest-numbered Camel Quarkus; this reproducer uses Camel Quarkus **3.39.0** (Camel 4.22.0, affected), with

> **3.40.0** (Camel 4.22.1) as the patched control. Both modules therefore demonstrate the affected **and** the

The app embeds a deliberately **malicious SFTP server** (Apache MINA SSHD). It serves a real temporary directory

tree but rewrites, in its `SSH_FXP_READDIR` , the name of one file in the polled directory `/upload` to the

traversal string `d/../../outside.txt` (via a `getShortName` override). The name does not start with a dot, so

Camel's hidden-file rule does not catch it, and `/upload` + `d/../../outside.txt` resolves to `/outside.txt`, one

level above the polled directory. A plain `mina-sftp` consumer polls `/upload`.

- **Affected**: it retrieves both `normal.txt` and the escaping `/outside.txt`.

- **Fixed**: it keeps `normal.txt` and skips the escaping entry, logging

`Skipping file as it resolves outside the starting directory: upload/d/../../outside.txt`.

curl -s

name=[d/../../outside.txt] <<< FILE FROM OUTSIDE THE POLLED DIRECTORY

content: OUTSIDE-SECRET (/outside.txt, a file the consumer should never reach)

| **Component** | `camel-mina-sftp` (`mina-sftp` scheme) |

| **CWE** | CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) |

| **Attack vector** | A `READDIR` entry name (server-supplied) that is not a single path segment |

| **Impact** | Read — and, with `delete`/`move`/`readLock=rename`, delete or rename — files outside the polled directory, using the endpoint's credentials |

| **Affected Versions** | From 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1 |

| **Fixed Versions** | 4.18.5, 4.22.1, 4.23.0 |

| **JIRA** | [CAMEL-24487]( |

Advisory:

`GenericFileConsumer.isWithinStartingDirectory` (overridden by `RemoteFileConsumer`, from which the mina-sftp

consumer derives) compacts the resolved path and verifies, on path-segment boundaries, that it stays inside the

polled directory; an entry resolving outside is skipped with a warning while the legitimate entries still process.

Verify the server host key, constrain the consumer with `filter`/`antInclude`/`include` to accept only single-segment

names, and avoid `delete`/`move`/`preMove`/`moveFailed`/`readLock=rename` against servers whose listings are not

fully trusted. Where possible, confine the server account to the polled directory.

This repository is published for educational and defensive purposes: to help Apache Camel users understand the

vulnerability, verify whether they are affected, and confirm that upgrading resolves it. The malicious server and

the "secret" are inert local fixtures. Do not use this material against systems you do not own or operate.