CVE-2026-40047

camel-docling CLI Argument Injection / Path Traversal Reproducer CVE-2026-40047 This project demonstrates a CLI argument injection and path traversal vulnerability in Apache Camel's camel-docling component, tracked as CVE-2026-40047. DoclingProducer builds the invocation of the external docling...

CVE-2026-78163

CVE-2026-78163 — camel-docling: unvalidated body input source SSRF + local file disclosure Runnable proof-of-concept reproducer for the Apache Camel vulnerability where DoclingProducer decided what a String message body meant by inspecting its prefix : a body starting with http:// or https:// was...

docling-core-CVE-2026-24009

CVE-2026-24009 — docling-core Unsafe YAML Deserialization PoC + Notes This repo contains a proof-of-concept PoC and a simple scanner demonstrating CVE-2026-24009 , where docling-core can enable code execution when loading attacker-controlled YAML under specific dependency conditions. TL;DR Impact...

CVE-2026-95629

CVE-2026-95629 — camel-docling: the output-path header reached --output verbatim Runnable proof-of-concept reproducer for the Apache Camel vulnerability where DoclingProducer, running the external docling tool in CLI mode the default, handed the value of the CamelDoclingOutputFilePath header to...

CVE-2026-95628

CVE-2026-95628 — camel-docling: validatePathSafety did not reject absolute paths incomplete fix of CVE-2026-40047 Runnable proof-of-concept reproducer for the Apache Camel vulnerability where the custom-argument path check that CVE-2026-40047's fix introduced looked only for relative traversal. I...

apache-camel-docling-security-assessment

CVE-2026-40047 - Apache Camel Docling CLI Argument Injection Consultant-Style Cybersecurity Report Professional vulnerability assessment report for Apache Camel Docling argument validation risk, including technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

CVE-2026-95629

A flaw was found in the camel-docling component of Apache Camel. The component fails to validate or sanitize directory paths specified in message headers before passing them to the underlying document conversion tool. An attacker able to influence message headers can exploit this path traversal...

CVE-2026-95628

A flaw was found in the Apache Camel Docling component. A remote attacker able to influence message headers can exploit this path traversal vulnerability by providing absolute paths in custom command-line arguments. Because the component only checks for relative traversal sequences, absolute path...

CVE-2026-78163

A flaw was found in the Apache Camel Docling component. This issue can lead to sensitive information disclosure because the component automatically determines whether to treat input text as document content, a local file path, or an external web address based solely on its prefix. A remote attack...

Exploit for CVE-2026-95628

CVE-2026-95628 — camel-docling: validatePathSafety did not r...

Apache Camel 4.22.1 Docling Output Path Traversal

Apache Camel version 4.22.1 camel-docling passes the CamelDoclingOutputFilePath header directly to Docling's output-directory option, allowing conversion output to be written to an attacker-selected writable directory. The supplied proof of concept demonstrates the issue in Spring Boot and Quarku...

Apache Camel camel-docling 4.22.1 Absolute Path Validation Bypass

Apache Camel camel-docling version 4.22.1 contains an improper pathname restriction that permits absolute paths in allowlisted custom CLI arguments. The proof of concept demonstrates the paths reaching the docling command line. https://packetstorm.news/download/238170...

org.apache.camel.karaf:camel-docling (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-docling (>=3.29.0, <=3.33.3) +3 more potentially affected by CVE-2026-95629 via org.apache.camel:camel-docling (>=4.15.0, <=4.18.4)

org.apache.camel:camel-docling MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.31.0, =4.15.0, =4.18.4 Source cves: CVE-2026-95629 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21816679...

org.apache.camel.quarkus:camel-quarkus-docling (>=3.35.0, <=3.40.0), org.apache.camel.quarkus:camel-quarkus-docling-deployment (>=3.35.0, <=3.40.0) +2 more potentially affected by CVE-2026-95629 via org.apache.camel:camel-docling (>=4.19.0, <=4.22.1)

org.apache.camel:camel-docling MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.1 Source cves: CVE-2026-95629 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21816679...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the addOutputDirectoryArguments method in the camel-docling component. An attacker who can influence the CamelDoclingOutputFilePath header can supply an absolute path or one containing .. segments, causing the...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the validatePathSafety method in the Docling producer. An attacker can make the external docling process use a directory accessible to the Camel process, outside the intended working directory, by supplying an...

org.apache.camel.karaf:camel-docling (>=4.18.1, <=4.18.4), org.apache.camel.quarkus:camel-quarkus-docling (>=3.29.0, <=3.33.3) +3 more potentially affected by CVE-2026-95628 via org.apache.camel:camel-docling (>=4.15.0, <=4.18.4)

org.apache.camel:camel-docling MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.31.0, =4.15.0, =4.18.4 Source cves: CVE-2026-95628 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21816698...

org.apache.camel.quarkus:camel-quarkus-docling (>=3.35.0, <=3.40.0), org.apache.camel.quarkus:camel-quarkus-docling-deployment (>=3.35.0, <=3.40.0) +2 more potentially affected by CVE-2026-95628 via org.apache.camel:camel-docling (>=4.19.0, <=4.22.1)

org.apache.camel:camel-docling MAVEN version =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.22.1 Source cves: CVE-2026-95628 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-21816698...

CVE-2026-95629

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer runs the external docling tool in CLI mode, the default, and tells i...

CVE-2026-95628

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2. DoclingProducer builds the command line of the external docling tool and appends to ...