Sploitus

Exploit for CVE-2026-40048

kitploit · 2026-08-25

Exploit Code

MARKDOWN8 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-OSCERD-CVE-2026-40048
# camel-pqc FileBasedKeyLifecycleManager Unsafe Deserialization Reproducer (CVE-2026-40048)

This project demonstrates a **Java deserialization vulnerability** in Apache Camel's `camel-pqc` component, tracked as **CVE-2026-40048**. `FileBasedKeyLifecycleManager` reads `<keyId>.key` files from the configured key directory with a raw `ObjectInputStream` and no `ObjectInputFilter`, so an attacker who can write to that directory can achieve **remote code execution**.

Advisory: https://camel.apache.org/security/CVE-2026-40048.html

## Vulnerability Summary