CVE-2015-0264
Apache Camel allows remote actor to read arbitrary files via external entity in invalid XML string or GenericFile object
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Exploit likelihood
What each source reports
NVD Score used
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
- Record
CVE-2015-0264- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
- Record
CVE-2015-0264- Updated
- 2026-11-02
EUVDEUVD-2018-0641 No score
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
- Record
EUVD-2018-0641- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mhx2-r3jx-g94c No score
Apache Camel allows remote actor to read arbitrary files via external entity in invalid XML string or GenericFile object
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
- Record
GHSA-mhx2-r3jx-g94c- Updated
- 2026-11-02
OSVGHSA-mhx2-r3jx-g94c No score
Apache Camel allows remote actor to read arbitrary files via external entity in invalid XML string or GenericFile object
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
- Record
GHSA-mhx2-r3jx-g94c- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.camel:camel-coreMaven |
before 2.13.4 | 2.13.4 |
org.apache.camel:camel-coreMaven |
2.14.0 up to 2.14.2 | 2.14.2 |
org.apache.camel:camel-coreMaven |
before 2.13.4, plus listed versions 1.0.01.1.01.2.01.3.01.4.0 Show 45 moreShow less1.5.01.6.01.6.11.6.21.6.31.6.42.0-M12.0-M22.0-M32.0.02.1.02.10.02.10.12.10.22.10.32.10.42.10.52.10.62.10.72.11.02.11.12.11.22.11.32.11.42.12.02.12.12.12.22.12.32.12.42.12.52.13.02.13.12.13.22.13.32.2.02.3.02.4.02.5.02.6.02.7.02.7.12.7.22.7.32.7.42.7.5 |
2.13.4 |
org.apache.camel:camel-coreMaven |
2.14.0 up to 2.14.2, plus listed versions 2.14.1 |
2.14.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0264 is a medium vulnerability (CVSS 5.0) in Apache Camel, published June 3, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.10%, the 94th percentile. Fixed in org.apache.camel:camel-core 2.13.4.
References
rhn.redhat.com/errata/RHSA-2015-1539.html
securitytracker.com/id/1032442
git-wip-us.apache.org/repos/asf?p=camel.git%3Ba=commitdiff%3Bh=1df559649a96a1ca0368373387e542f46e4820da
camel.apache.org/security-advisories.data/CVE-2015-0264.txt.asc
Show 11 moreShow less
lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2015-0264
github.com/advisories/GHSA-mhx2-r3jx-g94c
issues.apache.org/jira/browse/CAMEL-8312
Left out here: 17 versions. The JSON record has them.