PT-2026-2851 · Apache+1 · Apache Camel+2

Ya0H4Cker · Published 2026-01-14 · Updated 2026-01-15 · CVE-2025-66169

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.10.0 through 4.10.7 Apache Camel versions 4.14.0 through 4.14.2 Apache Camel versions 4.15.0 through 4.16.9

Description A Cypher Injection issue exists in the Apache Camel camel-neo4j component. This allows for potential unauthorized access or manipulation of data within a Neo4j database. The issue stems from insufficient input validation when processing Cypher queries. The component is susceptible to malicious Cypher code injection through user-supplied input.

Recommendations Upgrade to Apache Camel version 4.10.8 Upgrade to Apache Camel version 4.14.3 Upgrade to Apache Camel version 4.17.0

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-943

CWE-74

CWE-89

Related Identifiers

CVE-2025-66169

GHSA-4JRW-64VR-7G8M

Affected Products

Apache Camel

Neo4J

Camel-Neo4J

References · 15

• https://osv.dev/vulnerability/CVE-2025-66169 · Vendor Advisory
• https://camel.apache.org/security/CVE-2025-66169.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66169 · Security Note
• https://osv.dev/vulnerability/GHSA-4jrw-64vr-7g8m · Vendor Advisory
• https://github.com/apache/camel · Note
• https://github.com/apache/camel/pull/20037 · Note
• https://github.com/apache/camel/commit/e46c4c0ef542a64dc791253763a8273dfd7fb179 · Note
• https://github.com/apache/camel/pull/20036 · Note
• https://github.com/apache/camel/pull/20035 · Note
• https://github.com/apache/camel/commit/66715d3feb4ba15df30cffe437e45efeedfba10d · Note
• https://github.com/apache/camel/commit/723e2cd98ce4b4ceb1dd38837bc113fca0cef170 · Note
• https://twitter.com/CVEnew/status/2011555228366356897 · Twitter Post
• https://issues.apache.org/jira/browse/CAMEL-22719 · Note
• https://twitter.com/oss_security/status/2011625444664373464 · Twitter Post
• http://openwall.com/lists/oss-security/2026/01/13/5 · Note