CVE-2019-0226 Apache Karaf vulnerable to relative path traversal

What is CVE-2019-0226?

CVE-2019-0226 is a medium-severity path traversal vulnerability in Apache Karaf, published on 9 May 2019. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.

Weakness: CWE-22

Which versions are affected by CVE-2019-0226?

2 open source packages ship an affected version, including org.apache.karaf.config:org.apache.karaf.config.core. It affects 1 product.

Products include Apache Karaf.

How do I fix CVE-2019-0226?

Upgrade org.apache.karaf.config:org.apache.karaf.config.core to 4.2.5 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2019-0226 being exploited?

There is no known exploitation of CVE-2019-0226 in the wild and no public exploit code.

Other vulnerabilities in Apache Karaf

• CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation Critical 9.8
• CVE-2026-91048 Missing authorization in Apache Karaf Critical 9.8
• CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection Critical 9.8
• CVE-2018-11788 XML External Entity Reference in Apache Karaf Critical 9.8
• CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fjw4-39pg-vf4f.