CVE-2014-0002: Apache Camel's XSLT component allows remote attackers to read arbitrary files
Summary
CVE-2014-0002: Apache Camel's XSLT component allows remote attackers to read arbitrary files. Affects org.apache.camel:camel-core across 2 version ranges.
< 2.11.4
>= 2.12.0, < 2.12.3
Fixed in 2.11.4 or 2.12.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to build integration solutions using various protocols and technologies. The XSLT component in Apache Camel is responsible for transforming XML messages using XSLT stylesheets. This component is vulnerable to an XML External Entity (XXE) issue, which allows remote attackers to read arbitrary files and potentially have other unspecified impacts.
Vulnerability Detail
The XSLT component in Apache Camel before version 2.11.4 and 2.12.x before 2.12.3 is susceptible to an XML External Entity (XXE) vulnerability. This vulnerability arises when an XML document containing an external entity declaration is processed in conjunction with an entity reference. An attacker can exploit this vulnerability by crafting a malicious XML document that references external entities, allowing them to read arbitrary files on the system. This can lead to unauthorized access to sensitive information or the execution of arbitrary code with the privileges of the application.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.11.42.11.4 -
>= 2.12.0, < 2.12.32.12.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading Apache Camel is not immediately feasible, a possible workaround is to disable the XSLT component or restrict its usage to trusted sources only. This can be achieved by modifying the application's configuration to exclude or block the XSLT component. However, this workaround may impact the functionality of the application if it relies on the XSLT transformation capabilities provided by Apache Camel.
Conclusion
The XSLT component in Apache Camel is vulnerable to an XML External Entity (XXE) issue, which allows remote attackers to read arbitrary files and potentially have other unspecified impacts. It is crucial to upgrade Apache Camel to the recommended versions or apply the provided workaround to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-core →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to build integration solutions using various protocols and technologies.
The XSLT component in Apache Camel is responsible for transforming XML messages using XSLT stylesheets. It allows developers to apply XSLT transformations to XML data within their integration solutions.
An XML External Entity (XXE) vulnerability occurs when an XML parser processes external entities defined in the XML document. Attackers can exploit this vulnerability to read arbitrary files on the system or perform other unauthorized actions.
This vulnerability allows remote attackers to read arbitrary files on the system. Depending on the context and privileges of the application, this can lead to unauthorized access to sensitive information or the execution of arbitrary code.
To fix this vulnerability, it is recommended to upgrade Apache Camel to version 2.11.4 or later if using version 2.11.x, or version 2.12.3 or later if using version 2.12.x. Updating the Apache Camel dependency in the project's Maven configuration file (pom.xml) to the appropriate version and rebuilding the application will address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-core.
