CVE-2026-85249
Received Received - Intake

Improper Input Validation in Apache Camel Tika Component

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Tika producer mapped every metadata key parsed out of the submitted document onto the Exchange as a header, with no filter applied. Document metadata is attacker-controlled content: the party that supplies the file chooses the metadata keys it carries. A crafted document could therefore set Exchange headers that the rest of the route depends on, including headers in the Camel namespace such as CamelFileName, which downstream components use to decide where content is written. The pattern is the same header-injection class as the consumer advisories published previously, reached here through parsed file content rather than through a protocol header. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Parsed document metadata is now filtered through a HeaderFilterStrategy before it is mapped onto the Exchange. A route that was reading a metadata-derived header the filter now blocks will see it missing. For deployments that cannot upgrade immediately, strip the Camel namespace after the Tika producer with removeHeaders("Camel*") before any component that acts on those headers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-85249
EUVD
EUVD-2026-104190

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.0.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Improper Input Validation vulnerability in Apache Camel's Tika component. It affects versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The issue occurs because the Tika producer maps all document metadata keys directly to Exchange headers without filtering. Attackers can exploit this by submitting a crafted document with malicious metadata keys, which could manipulate Exchange headers like CamelFileName. This could lead to header injection, affecting downstream components that rely on these headers for file handling.

Detection Guidance

Detecting this vulnerability requires checking if your Apache Camel Tika component is running a vulnerable version. Use commands like 'camel --version' or check your application's dependency files (e.g., pom.xml for Maven) to verify the version. If the version is between 4.0.0 and 4.18.4 or 4.19.0 and 4.22.0, the system is vulnerable.

Impact Analysis

This vulnerability could allow an attacker to control file paths or other critical headers by injecting malicious metadata into a document. This might result in unauthorized file writes, data leaks, or disruption of services that depend on Camel's routing logic. Systems processing untrusted files are at higher risk.

Mitigation Strategies

Immediately upgrade Apache Camel to version 4.23.0 or apply the latest patches for your LTS stream (4.18.5 for 4.18.x or 4.22.1 for 4.22.x). If upgrading is not possible, add a 'removeHeaders("Camel*")' step in your route after the Tika producer to strip Camel namespace headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart