CVE-2015-0263: Apache Camel XML External Entity vulnerability
Summary
CVE-2015-0263: Apache Camel XML External Entity vulnerability. Affects org.apache.camel:camel-core across 2 version ranges.
< 2.13.4
>= 2.14.0, < 2.14.2
Fixed in 2.13.4 or 2.14.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and data formats. The Camel Core package is a fundamental component of Apache Camel, providing core functionality and utilities for message routing and transformation.
This vulnerability affects versions of Apache Camel before 2.13.4 and 2.14.x before 2.14.2.
Vulnerability Detail
The vulnerability, known as XML External Entity (XXE), exists in the XML converter setup in converter/jaxp/XmlConverter.java. It allows remote attackers to read arbitrary files by exploiting an external entity in an SAXSource. By crafting a malicious XML input, an attacker can trigger the XXE vulnerability and gain unauthorized access to sensitive files on the server.
This vulnerability has a moderate severity rating and is classified under CWE-611.
How To Fix
Latest published version: 4.23.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.13.42.13.4 -
>= 2.14.0, < 2.14.22.14.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the XML converter in Apache Camel by removing or commenting out the relevant configuration. However, this may impact the functionality of applications relying on XML conversion in Camel. It is strongly advised to apply the recommended fix by upgrading to the patched versions.
Conclusion
The Apache Camel XML External Entity vulnerability (CVE-2015-0263) allows remote attackers to read arbitrary files on the server by exploiting an XXE vulnerability in the XML converter setup. To mitigate this vulnerability, it is crucial to upgrade to the recommended patched versions of Apache Camel. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.camel:camel-core →
FAQ
Apache Camel is an open-source integration framework that provides a rule-based routing and mediation engine. It allows developers to integrate different systems using various protocols and data formats.
XML External Entity (XXE) vulnerability is a type of attack that exploits the processing of XML input containing external entities. By including malicious external entities, an attacker can read arbitrary files on the server.
This vulnerability allows remote attackers to read arbitrary files on the server, potentially exposing sensitive information. The impact depends on the files accessible to the application and the permissions of the user running the application.
To fix this vulnerability, it is recommended to upgrade to Apache Camel version 2.13.4 or later if using versions prior to 2.14.x, or upgrade to version 2.14.2 or later if using versions in the 2.14.x range.
As a temporary workaround, you can disable the XML converter in Apache Camel by removing or commenting out the relevant configuration. However, it is strongly advised to apply the recommended fix by upgrading to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.camel:camel-core.
