CVE-2026-88901

CVE-2026-88901 is an XML external entity (XXE) flaw in camel-smooks, the Apache Camel data format and component for Smooks. Apache published the advisory on 15 October 2026. The CVE record and NVD entry followed on 19 October.

Smooks parses XML with its default reader, the Woodstox SAX parser. That reader resolves external entities and loads external DTDs. Camel-smooks applied none of the hardening the other Camel XML components use.

A sender whose XML reaches a camel-smooks data format or endpoint can declare an external entity. That lets them read files the Camel process can read, or make it send requests to internal hosts. On request-reply routes, the resolved content can come back in the response.

No special option is needed; resolving entities was the default. Configurations that declare their own reader, such as EDI, CSV, JSON or a custom one, are not affected.

Apache scores it CVSS 3.1 8.2 (High). NVD shows the Apache score and has not added its own.

Affected: 4.7.0 before 4.18.5, and 4.19.0 before 4.22.1. Fixed: 4.18.5, 4.22.1 and 4.23.0. A new allowExternalEntities option, off by default, restores the old behaviour for trusted legacy setups. The 4.14.x line is end of life.

Before you can upgrade, Apache says not to apply camel-smooks to XML from untrusted senders.

The advisory credits h1ei1. A public reproducer repository is published by Andrea Cosentino (oscerd), the Camel PMC member who wrote the fix. ThreatWire did not run it.

The CVE is not in the CISA KEV catalog (catalog 2026.10.23). CISA's SSVC entry sets exploitation to none.

Read the full explainer on the eight Camel and Camel K flaws. An earlier Camel XXE flaw is covered in our Camel Quarkus XXE article.