CVE-2026-40047

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.15.0 through 4.18.2

Description An argument injection issue exists in the Apache Camel Docling component. The component uses java.lang.ProcessBuilder to execute the external docling command-line tool. When custom CLI arguments are provided via the CamelDoclingCustomArguments exchange header, the system fails to validate them properly, relying on a denylist of disallowed flags and a basic check for ../ sequences. This allows an attacker to inject unintended docling CLI flags or use directory traversal sequences to access files outside the intended directory. While the use of the list-based ProcessBuilder prevents OS command injection via shell metacharacters, the weak validation of the CamelDoclingCustomArguments header and path-bearing headers enables the injection of arguments passed to the external tool.

Recommendations Upgrade Apache Camel versions 4.15.0 through 4.17.x to version 4.19.0 or later. Upgrade Apache Camel version 4.18.x to version 4.18.3. Avoid mapping untrusted message content into the CamelDoclingCustomArguments header and path-bearing headers. Strip Camel-internal headers from messages arriving from untrusted producers.