Moderate severityNVD Advisory· Published Sep 17, 2018· Updated Sep 17, 2024

CVE-2018-8041

Description

Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Camel Mail 2.20.0–2.22.0 is vulnerable to path traversal through crafted email attachments, enabling unauthorized file access.

Vulnerability

Apache Camel's Mail component versions 2.20.0 through 2.20.3, 2.21.0 through 2.21.1, and 2.22.0 are vulnerable to a path traversal weakness [1][2][3][4]. The issue arises from insufficient sanitization of attachment filenames when processing email messages. An attacker can craft an email attachment whose filename contains path traversal sequences (e.g., ../../), which the component then resolves relative to the intended directory, bypassing access controls.

Exploitation

Exploitation requires the ability to send a malicious email to an application using the vulnerable Apache Camel Mail component. The attacker does not need prior authentication or network access beyond email delivery; the vulnerable code path is triggered automatically when the component processes incoming mail with attachments. The attacker crafts an email attachment with a filename containing path traversal sequences, and when Camel's mail consumer saves or accesses the attachment, the traversal sequences are honored, allowing the attacker to write or read files outside the intended directory.

Impact

Successful exploitation results in a path traversal condition that can lead to unauthorized file read or write. An attacker may read sensitive configuration files or write malicious content to arbitrary locations on the filesystem, potentially escalating to arbitrary code execution or data exfiltration. The impact depends on the file system permissions of the user running the Camel application and the specific deployment context.

Mitigation

The vulnerability is fixed in Apache Camel versions 2.20.4, 2.21.2, and 2.22.1 [1][2]. Users should upgrade immediately to the latest patched version for their release stream. If upgrading is not possible, a workaround is to avoid processing untrusted email attachments or to implement a custom attachment handler that validates filenames against known-safe patterns.

References

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.apache.camel:camel-mailMaven	>= 2.20.0, < 2.20.4	2.20.4
org.apache.camel:camel-mailMaven	>= 2.21.0, < 2.21.2	2.21.2
org.apache.camel:camel-mailMaven	>= 2.22.0, < 2.22.1	2.22.1

Affected products

Apache/Camel Mailllm-create
Range: 2.20.0-2.20.3, 2.21.0-2.21.1, 2.22.0
ghsa-coords
pkg:maven/org.apache.camel/camel-mail
Range: >= 2.20.0, < 2.20.4
Apache/Apache Camelcpe-rescue
Range: Camel 2.20.0 to 2.20.3, Camel 2.21.0 to 2.21.1 and Camel 2.22.0

Patches

a0d25d9582c6

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -119,6 +119,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

a0d25d9582c6

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -119,6 +119,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

4f401c09d22c

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -119,6 +119,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

63c7c080de4d

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -125,6 +125,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

4580e4d6c65c

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -119,6 +119,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

4f401c09d22c

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -119,6 +119,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

63c7c080de4d

CAMEL-12630: better attachment handling in came...

https://github.com/apache/camelZoran RegvartJul 9, 2018via ghsa

commit

4 files changed · +147 −2

components/camel-mail/pom.xml+6 −0 modified

@@ -125,6 +125,12 @@
           <artifactId>camel-quartz2</artifactId>
           <scope>test</scope>
         </dependency>
+        <dependency>
+          <groupId>org.assertj</groupId>
+          <artifactId>assertj-core</artifactId>
+          <version>${assertj-version}</version>
+          <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>

components/camel-mail/src/main/java/org/apache/camel/component/mail/DelegatingDataSource.java+59 −0 added

@@ -0,0 +1,59 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+
+import javax.activation.DataSource;
+
+import org.apache.camel.util.ObjectHelper;
+import org.apache.camel.util.StringHelper;
+
+final class DelegatingDataSource implements DataSource {
+
+    private final DataSource delegate;
+
+    private final String name;
+
+    public DelegatingDataSource(final String name, final DataSource delegate) {
+        this.name = StringHelper.notEmpty(name, "name");
+        this.delegate = ObjectHelper.notNull(delegate, "DataSource");
+    }
+
+    @Override
+    public String getContentType() {
+        return delegate.getContentType();
+    }
+
+    @Override
+    public InputStream getInputStream() throws IOException {
+        return delegate.getInputStream();
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public OutputStream getOutputStream() throws IOException {
+        return delegate.getOutputStream();
+    }
+
+}

components/camel-mail/src/main/java/org/apache/camel/component/mail/MailBinding.java+7 −2 modified

@@ -52,6 +52,7 @@
 import org.apache.camel.impl.DefaultHeaderFilterStrategy;
 import org.apache.camel.spi.HeaderFilterStrategy;
 import org.apache.camel.util.CollectionHelper;
+import org.apache.camel.util.FileUtil;
 import org.apache.camel.util.IOHelper;
 import org.apache.camel.util.ObjectHelper;
 import org.slf4j.Logger;
@@ -314,7 +315,7 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                 extractAttachmentsFromMultipart((Multipart) part.getContent(), map);
             } else {
                 String disposition = part.getDisposition();
-                String fileName = part.getFileName();
+                String fileName = FileUtil.stripPath(part.getFileName());
 
                 if (LOG.isTraceEnabled()) {
                     LOG.trace("Part #{}: Disposition: {}", i, disposition);
@@ -330,7 +331,11 @@ protected void extractAttachmentsFromMultipart(Multipart mp, Map<String, Attachm
                     LOG.debug("Mail contains file attachment: {}", fileName);
                     if (!map.containsKey(fileName)) {
                         // Parts marked with a disposition of Part.ATTACHMENT are clearly attachments
-                        DefaultAttachment camelAttachment = new DefaultAttachment(part.getDataHandler());
+                        final DataHandler dataHandler = part.getDataHandler();
+                        final DataSource dataSource = dataHandler.getDataSource();
+
+                        final DataHandler replacement = new DataHandler(new DelegatingDataSource(fileName, dataSource));
+                        DefaultAttachment camelAttachment = new DefaultAttachment(replacement);
                         @SuppressWarnings("unchecked")
                         Enumeration<Header> headers = part.getAllHeaders();
                         while (headers.hasMoreElements()) {

components/camel-mail/src/test/java/org/apache/camel/component/mail/MailBindingAttachmentFileTest.java+75 −0 added

@@ -0,0 +1,75 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.mail;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.activation.DataHandler;
+import javax.mail.Message;
+import javax.mail.MessagingException;
+import javax.mail.Multipart;
+import javax.mail.Session;
+import javax.mail.internet.MimeBodyPart;
+import javax.mail.internet.MimeMessage;
+import javax.mail.internet.MimeMultipart;
+
+import org.apache.camel.Attachment;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameter;
+import org.junit.runners.Parameterized.Parameters;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+@RunWith(Parameterized.class)
+public class MailBindingAttachmentFileTest {
+
+    @Parameter
+    public String name;
+
+    private final MailBinding binding = new MailBinding();
+
+    @Test
+    public void shouldSanitizeAttachmentFileNames() throws MessagingException, IOException {
+        final Session session = Session.getInstance(new Properties());
+        final Message message = new MimeMessage(session);
+
+        final Multipart multipart = new MimeMultipart();
+        final MimeBodyPart part = new MimeBodyPart();
+        part.attachFile(name);
+        multipart.addBodyPart(part);
+        message.setContent(multipart);
+
+        final Map<String, Attachment> attachments = new HashMap<>();
+        binding.extractAttachmentsFromMail(message, attachments);
+
+        assertThat(attachments).containsKey("file.txt");
+        final Attachment attachment = attachments.get("file.txt");
+        final DataHandler dataHandler = attachment.getDataHandler();
+        assertThat(dataHandler.getName()).isEqualTo("file.txt");
+    }
+
+    @Parameters(name = "{0}")
+    public static Iterable<String> fileNames() {
+        return Arrays.asList("file.txt", "../file.txt", "..\\file.txt", "/absolute/file.txt", "c:\\absolute\\file.txt");
+    }
+}

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

access.redhat.com/errata/RHSA-2018:3768ghsavendor-advisoryx_refsource_REDHATWEB
github.com/advisories/GHSA-jv74-f9pj-xp3fghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2018-8041ghsaADVISORY
camel.apache.org/security-advisories.data/CVE-2018-8041.txt.ascghsax_refsource_CONFIRMWEB
www.securityfocus.com/bid/105352ghsavdb-entryx_refsource_BIDWEB
github.com/apache/camel/commit/4580e4d6c65cfd544c1791c824b5819477c583ccghsaWEB
github.com/apache/camel/commit/4f401c09d22c45c94fa97746dc31905e06b19e3ghsaWEB
github.com/apache/camel/commit/63c7c080de4d18f9ceb25843508710df2c2c6d4ghsaWEB
github.com/apache/camel/commit/a0d25d9582c6ee85e9567fa39413df0b4f02ef7ghsaWEB
issues.apache.org/jira/browse/CAMEL-12630ghsax_refsource_CONFIRMWEB
lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3Emitremailing-listx_refsource_MLIST
lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3EghsaWEB
lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3Emitremailing-listx_refsource_MLIST
lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3EghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.002
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000