# CVE-2026-79985 — camel-smb: consumer builds the remote path from the listing without containment
Reproducer repository for the Apache Camel vulnerability where the `smb` consumer builds the remote path of each
polled file by concatenating the configured directory with the name reported in the SMB ** listing**, with no
containment check. `SmbConsumer` walks the listing itself (not through `RemoteFileConsumer`), skipping only the exact
`.` and `..` entries, so a name carrying traversal segments in any other form was concatenated unchecked — resolving
to a path outside the polled directory for retrieval and, with `delete`/`move`/`preMove`/`moveFailed`/
> **This reproducer is author-only** — see below — and is the SMB sibling of the runnable
> [CVE-2026-79983]( (`camel-ftp`) and
> [CVE-2026-79984]( (`camel-mina-sftp`), which demonstrate the identical
> root cause and fix **end to end** against an embedded malicious server.
As the advisory itself states, reaching the issue over SMB
> *"requires a server that emits a listing name which is not a single path segment, which a conforming SMB2
> implementation does not do; the exposure was corrected on the same basis as the other remote-file consumers rather
> than from a demonstrated proof of concept against this scheme."*
There is no embeddable malicious SMB server that emits such a name (unlike FTP, where Apache MINA FtpServer's VFS can
be made to, and SFTP, where Apache MINA SSHD's `getShortName` can be overridden). So this repository carries the
**exact affected consumer wiring** (a real `camel-smb` route, see `SmbRoute.java` / `SmbRoutes.java`) and documents
the mechanism and fix, and defers the runnable end-to-end demonstration to the FTP and SFTP reproducers above.
| **Camel Spring Boot** | [`camel-spring-boot/`](camel-spring-boot/) | Spring Boot 3.5.13 + camel-smb **4.22.0** (affected; fixed 4.22.1) |
| **Camel Quarkus** | [`camel-quarkus/`](camel-quarkus/) | Quarkus 3.29.0 + camel-quarkus-smb **3.29.0** (Camel **4.15.0**, affected) |
Both modules compile and start cleanly without an SMB server (the route is defined with `autoStartup=false`). Set
`-Dsmb.enabled=true` with `smb.host`/`smb. `/`smb.username`/`smb.password` to point the exact affected route at
curl -s # prints the explanation + links to the runnable PoCs
| **Component** | `camel-smb` (`smb` scheme) |
| **CWE** | CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) |
| **Attack vector** | A -listing name (server-supplied) that is not a single path segment |
| **Impact** | Read — and, with `delete`/`move`/`readLock=rename`, delete or rename — files outside the polled directory, using the endpoint's credentials |
| **Affected Versions** | From 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1 |
| **Fixed Versions** | 4.18.5, 4.22.1, 4.23.0 |
| **JIRA** | [CAMEL-24487]( |
Advisory:
`SmbConsumer` now applies the same containment check as the other remote-file consumers: a resolved path that falls
outside the polled directory is skipped with a warning, so a listing name carrying traversal segments no longer
reaches the retrieve/delete/rename operand.
Constrain the consumer with `filter`/`antInclude`/`include` to accept only single-segment names, and avoid
`delete`/`move`/`preMove`/`moveFailed`/`readLock=rename` against servers whose listings are not fully trusted. Where
possible, confine the server account to the polled directory.
This repository is published for educational and defensive purposes: to help Apache Camel users understand the
vulnerability, verify whether they are affected, and confirm that upgrading resolves it. Do not use this material
against systems you do not own or operate.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
