Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in…
CVE-2026-95664
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component. This issue affects Apache Camel: from 4.8.0 before 4.18.5, from 4.19.0 before 4.22.2. For the object it uploads, reads or deletes, the camel-aws2-s3 producer takes the key from the CamelAwsS3Key message header and falls back to the keyName option configured on the endpoint only when that header is absent. Since 4.8.0, AWS2S3Utils.determineKey() also passed the resulting value to the Simple language whenever it contained ${ or $simple{, so that a route could use a dynamic key, and the evaluation applied to a value taken from the header as well as to the configured option. The header is not route configuration, however: the aws2-s3 consumer sets CamelAwsS3Key on the exchanges it creates to the key of the object it read, that is, the name of the object in the bucket. In a route that does nothing more than consume from one aws2-s3 endpoint and produce to another, the name of each consumed object therefore reached the producer, and a name containing either marker was evaluated as an expression, although the route author…
Proof-of-concept code is published
Public PoC
- Public PoCoscerd/CVE-2026-95664
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 5.4 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 26 October 2026
- Last updated
- 28 October 2026
- Weakness
- CWE-917
- Assigner
- security@apache.org
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
At the source
References
- https://camel.apache.org/security/CVE-2025-27636.html
- https://camel.apache.org/security/CVE-2026-78164.html
- https://camel.apache.org/security/CVE-2026-83531.html
- https://camel.apache.org/security/CVE-2026-95664.html
- https://github.com/apache/camel/pull/26746
- https://github.com/apache/camel/pull/26840
- https://github.com/apache/camel/pull/26841
- https://github.com/apache/camel/pull/26842
- https://github.com/apache/camel/pull/26889
- https://issues.apache.org/jira/browse/CAMEL-20971
- https://issues.apache.org/jira/browse/CAMEL-24901
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-95664