CVE-2026-95629

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.15.0 through 4.18.4 Apache Camel versions 4.19.0 through 4.22.1

Description Path Traversal issue in the Apache Camel Docling component. The DoclingProducer runs the external docling tool in CLI mode and uses the --output flag to specify the output directory. When the CamelDoclingOutputFilePath header is set, the addOutputDirectoryArguments function passes the value to the flag without normalization. This allows absolute paths or paths containing .. segments, enabling an attacker who can set the header to create conversion output files in any directory accessible to the Camel process. The issue occurs when routes forward externally influenced values into the header or when consumers map incoming headers without filtering the Camel header namespace. The docling-serve mode is not affected.

Recommendations Upgrade to version 4.23.0. Upgrade to version 4.22.2 for those on the 4.22.x release stream. Upgrade to version 4.18.5 for those on the 4.18.x release stream. After upgrading, set the outputBaseDirectory endpoint option on every docling endpoint where the CamelDoclingOutputFilePath header can be influenced by external values. For deployments that cannot upgrade immediately, do not build the CamelDoclingOutputFilePath header from external values, remove this header from incoming messages before they reach a docling endpoint, and ensure consumers drop the Camel header namespace when mapping incoming message headers.