CVE-2026-88789
HighCVSS 8.6Summary
An XML External Entity (XXE) vulnerability exists in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus versions 3.2.0 before 3.33.3 and 3.34.0 before 3.40.0. The extension registers its own Xalan-J 2.7.x-backed TransformerFactory as the JAXP default, and Xalan-J does not honour ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who supplies the XML document to read local files or make requests to internal network locations.
Risk Assessment
An attacker able to supply the XML document being transformed can read local files or issue requests to internal network resources, leading to data disclosure and server-side request forgery (SSRF). Applications using camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity are affected.
Recommendation
Upgrade Apache Camel Quarkus to version 3.33.3 or 3.40.0, which fixes this issue. Until the upgrade, avoid processing untrusted XML documents through the xslt component.
Related vulnerabilities
- CVE-2026-96677Critical
Cross-site Scripting (XSS) vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in page chrome fields (header, nav, footer, etc.), so applications that place request-derived values there reflect them unencoded.
- CVE-2026-73117Critical
HTTP Response Splitting (CRLF injection in HTTP headers) vulnerability in Apache Juneau. The REST server passed response header values and redirect targets to the servlet container unchecked, so request-derived data could allow header injection or redirect to an arbitrary site.
- CVE-2026-73116Critical
Insufficiently Protected Credentials vulnerability in Apache Juneau. The RestClient followed HTTP redirects while keeping credential headers from the original request, so a server redirecting to a different host, port, or from HTTPS to HTTP could receive Authorization, Cookie, Proxy-Authorization and X-API-Key headers.
- CVE-2026-73101Critical
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response and may include internal exception messages in the error body, even with stack-trace rendering disabled.
- CVE-2026-73100Critical
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests ending in a server error without redaction, so Authorization, Cookie, Proxy-Authorization and X-API-Key headers are written in cleartext to the application log.
- CVE-2026-73099Critical
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body and is enabled by default on every HTTP method including GET, so a cross-site link can deliver an attacker-chosen request body without a CORS preflight.
- CVE-2026-73098Critical
Improper control of dynamically-loaded code vulnerability in Apache Juneau. When parsing a value into a property of type java.lang.Class, the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer.
- CVE-2026-121489Critical
Path Traversal vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory; when an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root.
- CVE-2026-100109Critical
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role. This allows unauthenticated attackers to create administrator accounts and take over the site.
- CVE-2026-123025Critical
An OS command injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense os-acme-client plugin through 4.17. The DnsGcloud::prepare() method decodes the dns_gcloud_key model field and directly interpolates the gcloud_account and gcloud_project string fields into a shell command passed to proc_open() via LeUtils::run_shell_command() without validation or escaping. A remote authenticated user with privileges to issue or renew certificates through the WebGUI/API can achieve arbitrary code execution as root.
Original NVD description (English source)
Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or issue requests to internal network locations via an external entity declaration in that document. The extension supplies its own Xalan-backed TransformerFactory to the xslt component and registers it as the JAXP default. Xalan-J 2.7.x predates JAXP 1.5 and does not honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET, so the external access restrictions Apache Camel applies to the TransformerFactory it creates were not in effect. On the xslt component path this affects message bodies that reach the transformer already as a javax.xml.transform.Source; bodies of other types are converted to a SAXSource by Apache Camel with external entities and external DTD loading disabled, and are not affected. Because the factory is also the JAXP default, other code in the application obtaining one through TransformerFactory.newInstance() loses the same restrictions without error. Applications are affected if they use any of camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity, each of which brings the XSLT support extension onto the classpath. For all but camel-quarkus-xslt, the exposure is limited to the JAXP default factory, since those extensions do not perform XSLT transformations themselves. Users are recommended to upgrade to version 3.33.3 or 3.40.0, which fixes this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS