CVE-2026-88901
Received Received - Intake

XML External Entity Injection in Apache Camel Smooks

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component (camel-smooks) in Apache Camel allows an attacker who supplies the XML message body to read local files or issue requests to internal network locations via an external entity declaration in that body. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. The Smooks data format (.unmarshal().smooks(...)) and the Smooks component (smooks:) parse the incoming XML body with the reader Smooks resolves by default, which is the Woodstox SAX parser. That reader resolves external general and parameter entities and loads external DTDs, and camel-smooks applied none of the parser hardening that the other Camel XML components apply. A DOCTYPE with an external subset, or an external general entity, declared in the XML document is therefore resolved and expanded while the body is unmarshalled, and the resolved content is bound into the unmarshalled result and returned on InOut routes. An external sender whose XML reaches a camel-smooks data format or endpoint could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. No non-default option is required, since resolving external entities was the default behaviour. Configurations that declare their own reader - EDI, CSV, JSON, or a custom reader - do not use the XML reader and are not affected. Users are recommended to upgrade to version 4.18.5, 4.22.1 or 4.23.0, which fixes the issue. Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. camel-smooks now parses the XML body with a javax.xml.parsers.DocumentBuilder that does not resolve external general or parameter entities and does not load external DTDs, and hands Smooks the resulting document, matching the secure XML processing configuration used by org.apache.camel.converter.jaxp.XmlConverter and the other Camel XML components. This hardening is applied only when the Smooks configuration parses XML with its default reader, so EDI, CSV, JSON and custom-reader configurations, and the marshalling direction, are unchanged. A new allowExternalEntities option, disabled by default, restores the previous behaviour for trusted legacy configurations that rely on external entity resolution. The camel-4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not apply camel-smooks to XML received from untrusted senders.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-88901
EUVD
EUVD-2026-104206

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Apache Software Foundation Apache Camel 4.7.0
Apache Software Foundation Apache Camel 4.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88901 is an XML External Entity (XXE) vulnerability in Apache Camel's Smooks component (camel-smooks). It occurs because the component parses XML input using a default reader that resolves external entities and DTDs, unlike other XML components in Camel which disable this behavior for security. This allows attackers supplying malicious XML to read local files or make requests to internal network hosts via external entity declarations.

Detection Guidance

Detecting this vulnerability requires checking Apache Camel versions and configurations. Use commands like 'camel --version' to verify if your system runs affected versions (4.7.0 to <4.18.5 or 4.19.0 to <4.22.1). Inspect XML processing components for camel-smooks usage in routes or data formats. Monitor logs for unusual file access or internal network requests that may indicate XXE exploitation.

Impact Analysis

An attacker could exploit this to read sensitive files accessible by the Camel process or send requests to internal systems, potentially leading to data breaches or unauthorized access. Systems processing untrusted XML via camel-smooks are at risk until patched.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's safeguards for protected health information. Non-compliance risks include fines, legal penalties, and reputational damage due to potential breaches.

Mitigation Strategies

Upgrade Apache Camel to version 4.18.5, 4.22.1, or 4.23.0 immediately. If upgrading is not possible, avoid using camel-smooks with XML from untrusted sources as a temporary measure. Disable external entity resolution in XML parsers if custom configurations are used.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart