Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Apache Camel: Remote Code Execution via Malicious File Names

CVE-2013-4330 · published 13 years ago
Summary

Apache Camel, a popular integration framework, contains a vulnerability that allows an attacker to execute arbitrary code on a server by sending a specially crafted file name. This could potentially allow an attacker to access or modify sensitive data. Users of Apache Camel should upgrade to a fixed version to protect against this vulnerability.

What to do
  • Update apache org.apache.camel:camel-core to version 2.9.7.
  • Update apache org.apache.camel:camel-core to version 2.10.7.
  • Update apache org.apache.camel:camel-core to version 2.11.2.
  • Update apache org.apache.camel:camel-core to version 2.12.1.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.camel:camel-core < 2.9.7
>= 2.10.0, < 2.10.7
>= 2.11.0, < 2.11.2
2.12.0
Fix: upgrade to 2.9.7
– apache camel <= 2.9.6
1.0.0
1.1.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
36 more version ranges
cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*
Original advisory text
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileNam...
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
References
Severity
6.8 Medium
Exploitation
8% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published4 Oct 2013
Updated15 Oct 2026
First seen6 Mar 2026
Sources
GHSA-x9fv-c87w-55wc · GHSA
CVE-2013-4330 · NVD
Track software like this
Free during beta