-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.camel:camel-core | maven | < 2.9.7 | 2.9.7 |
| org.apache.camel:camel-core | maven | >= 2.10.0, < 2.10.7 | 2.10.7 |
| org.apache.camel:camel-core | maven | >= 2.11.0, < 2.11.2 | 2.11.2 |
| org.apache.camel:camel-core | maven | = 2.12.0 | 2.12.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how the createFileName function handled the CamelFileName header. The original implementation parsed and evaluated Simple Language expressions directly from the header value without proper validation. The GitHub patch commits (e.g., 2281b1f) show modifications to this function to disable direct evaluation of String-based $simple{} expressions in headers, replacing it with type-safe Expression object handling. The CVE description explicitly references header manipulation via $simple{} as the attack vector, and the patched code adds warnings about this deprecated behavior, confirming the function's role in the vulnerability.