CVE-2026-79984

--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce separator-aware containment checks and lexical normalization on remote directory listing entries before invoking file retrieval, deletion, or renaming operations: upgrade to Apache Camel 4.18.5, 4.22.1, or 4.23.0+ (or the fixed Camel Mina Sftp builds), which skip listing entries that resolve outside the configured starting directory using separator-aware containment checks, closing all 3 injection vectors (crafted remote directory listing entries, on-path directory listing response manipulation, crafted fileName expressions with traversal segments). Until patched, this is a concern on Camel applications with remote-file consumers polling untrusted, multi-tenant, or network-exposed servers, so Constrain consumer filenames to single segments via filter or include patterns, avoid destructive disposition options such as delete or move, verify remote host keys, and confine remote accounts on the server. As a compensating measure, Restrict path characters by rejecting directory listing entries containing non-allowlisted characters or traversal sequences prior to path concatenation and Encrypt transport traffic using IPsec or WireGuard to prevent on-path network adversaries from tampering with directory listing responses. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)