CVE-2026-85250

{
  "etk_id": "ETK-2026-2176",
  "cve_id": "CVE-2026-85250",
  "display_id": "CVE-2026-85250",
  "ghsa_id": "GHSA-x9f8-58m2-93q2",
  "euvd_id": "EUVD-2026-104191",
  "status": "published",
  "anchor_state": "anchored",
  "title": "XML external entity injection in Apache Camel XPath",
  "summary": "Apache Camel's camel-xpath package is affected in versions 4.0.0 through 4.18.4 and 4.19.0 through 4.22.0 when XPath processing uses the InputSource document type. An unauthenticated attacker who can submit XML to that processing path may read files accessible to the Camel process or induce outbound requests through external entity resolution.",
  "mitigation": "Upgrade camel-xpath to 4.18.5 or 4.22.1, or to Apache Camel 4.23.0 where applicable. Until upgraded, do not use InputSource for XPath expressions that process untrusted XML; use the default document type and avoid parser-property overrides that relax external-entity protections.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Camel",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 4.0.0, < 4.18.5",
        ">= 4.19.0, < 4.22.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "4.18.5",
        "4.22.1"
      ],
      "package_name": "org.apache.camel:camel-xpath",
      "purl": null
    }
  ],
  "cwes": [
    611
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": 0.0054,
  "epss_percentile": 0.4446,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.229323433333334,
  "t0_at": "2026-10-19T10:35:21.670000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-10-19T13:46:09+00:00",
      "days": 0.13249224537037038,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T10:35:21.670000+00:00",
      "url": "https://github.com/oscerd/CVE-2026-85250"
    },
    "trigger_signal": {
      "at": "2026-10-19T10:35:21.670000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T10:35:21.670000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85250"
    }
  }
}