{"id":"CVE-2018-8041","aliases":["EUVD-2018-0633","GHSA-jv74-f9pj-xp3f"],"status":"published","title":"Apache Camel's Mail is vulnerable to path traversal","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.09586,"percentile":0.95507,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-22"],"published":"2018-09-17T14:00:00Z","modified":"2026-10-24T10:31:04Z","exploits":[{"source":"pocgithub","id":"shoucheng3/apache__camel_CVE-2018-8041_2-20-3","title":"shoucheng3/apache__camel_CVE-2018-8041_2-20-3","date":"2025-08-18","url":"https://github.com/shoucheng3/apache__camel_CVE-2018-8041_2-20-3"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.camel:camel-mail","fixed_in":["2.20.4","2.21.2","2.22.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.2"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.camel:camel-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"last_affected":"2.22.0"},{"fixed":"2.22.1"}]}],"versions":["2.22.0"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.4"}]}],"versions":["2.20.0","2.20.1","2.20.2","2.20.3"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.2"}]}],"versions":["2.21.0","2.21.1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.camel:camel-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.1"}]}],"versions":["2.22.0"]}],"products":[{"vendor":"apache","product":"camel"},{"vendor":"apache software foundation","product":"apache camel"}],"references":[{"url":"http://camel.apache.org/security-advisories.data/CVE-2018-8041.txt.asc?version=1\u0026modificationDate=1536746339000\u0026api=v2","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/105352","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://issues.apache.org/jira/browse/CAMEL-12630","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3768","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf%40%3Ccommits.camel.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8041","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jv74-f9pj-xp3f","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/2318d7f7d87724d8716cd650c21b31cb06e4d34f6d0f5ee42f28fdaf@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/b4014ea7c5830ca1fc28edd5cafedfe93ad4af2d9e69c961c5def31d@%3Ccommits.camel.apache.org%3E","tags":["web"]},{"url":"https://github.com/apache/camel/commit/4580e4d6c65cfd544c1791c824b5819477c583cc","tags":["web"]},{"url":"https://github.com/apache/camel/commit/4f401c09d22c45c94fa97746dc31905e06b19e3","tags":["web"]},{"url":"https://github.com/apache/camel/commit/63c7c080de4d18f9ceb25843508710df2c2c6d4","tags":["web"]},{"url":"https://github.com/apache/camel/commit/a0d25d9582c6ee85e9567fa39413df0b4f02ef7","tags":["web"]},{"url":"https://github.com/apache/camel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-8041","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","status":"published","published":"2018-09-17T14:00:00Z","modified":"2024-09-17T04:29:13.153Z","updated_at":"2026-11-02T14:35:04.172099Z"}],"euvd":[{"id":"EUVD-2018-0633","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","status":"published","published":"2018-09-17T14:00:00Z","modified":"2024-09-17T04:29:13Z","updated_at":"2026-11-03T00:28:22.706109Z"}],"ghsa":[{"id":"GHSA-jv74-f9pj-xp3f","title":"Apache Camel's Mail is vulnerable to path traversal","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","status":"published","published":"2018-10-16T23:07:57Z","modified":"2023-12-19T22:13:45Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:27.414424Z"}],"nvd":[{"id":"CVE-2018-8041","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","status":"published","published":"2018-09-17T14:29:00.92Z","modified":"2026-06-17T02:04:09.737Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:40.661264Z"}],"osv":[{"id":"CVE-2018-8041","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","status":"published","published":"2018-09-17T14:29:00.92Z","modified":"2026-10-24T10:31:04.761508627Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"},{"id":"GHSA-jv74-f9pj-xp3f","title":"Apache Camel's Mail is vulnerable to path traversal","description":"Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.","status":"published","published":"2018-10-16T23:07:57Z","modified":"2024-02-16T08:04:22.900514Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:51.10002Z"}]}}