CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or issue requests to internal network locations via an external entity declaration in that document. The extension supplies its own Xalan-backed TransformerFactory to the xslt component and registers it as the JAXP default. Xalan-J 2.7.x predates JAXP 1.5 and does not honour javax.xml.XMLConstants.ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET, so the external access restrictions Apache Camel applies to the TransformerFactory it creates were not in effect. On the xslt component path this affects message bodies that reach the transformer already as a javax.xml.transform.Source; bodies of other types are converted to a SAXSource by Apache Camel with external entities and external DTD loading disabled, and are not affected. Because the factory is also the JAXP default, other code in the application obtaining one through TransformerFactory.newInstance() loses the same restrictions without error. Applications are affected if they use any of camel-quarkus-xslt, camel-quarkus-xslt-saxon, camel-quarkus-tika or camel-quarkus-xmlsecurity, each of which brings the XSLT support extension onto the classpath. For all but camel-quarkus-xslt, the exposure is limited to the JAXP default factory, since those extensions do not perform XSLT transformations themselves. Users are recommended to upgrade to version 3.33.3 or 3.40.0, which fixes this issue.

• CWE-611

• https://camel.apache.org/security/CVE-2026-88789.html
• https://github.com/apache/camel-quarkus/commit/9a570b64977b0e24f85d67c2b2220aeac9fa5274
• https://github.com/apache/camel-quarkus/commit/9dd11779580cd88e4ab01b23717cd0167f26155c
• https://github.com/apache/camel-quarkus/issues/9115
• https://www.openwall.com/lists/oss-security/2026/10/01/1

Published

Oct 1, 2026

Last Modified

Oct 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8878Version 3.0.7 of the Securly Chrome Extension exposes multip…7.5
• CVE-2026-88782The Kubio AI Page Builder WordPress plugin before 2.9.3 does…6.8
• CVE-2026-88783The Kubio AI Page Builder WordPress plugin before 2.9.3 does…8.8
• CVE-2026-88784The Translate WordPress with Weglot 2.0 WordPress plugin be…7.5
• CVE-2026-88785The Simple Membership WordPress plugin before 4.8.3 does not…4.7
• CVE-2026-88788The Text Styler WordPress plugin through 1.1.1 does not sani…6.8
• CVE-2026-8879Version 3.0.7 of the Securly Chrome Extension dynamically re…7.5
• CVE-2026-88790A security vulnerability has been detected in proma-ai Proma…4.8
• CVE-2026-88791The Safe Redirect Manager WordPress plugin before 2.3.0 does…3.4
• CVE-2026-88792The Dictionary WordPress plugin through 1.0 does not have au…8.8
• CVE-2026-88793The YouTube Embed WordPress plugin from 10.0 to 10.3 does no…8.8
• CVE-2026-88794Enterprise Architect is vulnerable to XML External Entity (X…8.2