CVE-2026-95628

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.15.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.1

Description A path traversal issue exists in the Apache Camel Docling component. The DoclingProducer constructs a command line for an external docling tool using arguments from the CamelDoclingCustomArguments header. While a safety check validatePathSafety() was implemented to prevent relative path traversal (e.g., using ../), it fails to check for absolute paths. Consequently, an attacker who can control the custom arguments can provide an absolute path to point the docling process to any directory accessible by the Camel process, bypassing the intended directory restrictions. This occurs in the default CLI mode. The issue is exploitable if a route forwards external values into the header or if a consumer maps incoming headers without filtering the Camel header namespace.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.2 for those on the 4.22.x stream. Upgrade to version 4.18.5 for those on the 4.18.x stream. For versions 4.15.x through 4.17.x and 4.19.x through 4.21.x, migrate to a supported release as these have reached end of life. As a temporary mitigation, do not build the CamelDoclingCustomArguments header from external values, remove this header from external messages before they reach a docling endpoint, and ensure consumers drop the Camel header namespace when mapping incoming headers.