org.apache.camel.karaf:camel-docling (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-docling (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-40047 via org.apache.camel:camel-docling (>=4.15.0, <=4.18.2)

org.apache.camel:camel-docling MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.31.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40047 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-17892569...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the DoclingProducer custom CLI argument handling in camel-docling. An attacker can pass untrusted values through the CamelDoclingCustomArguments header to make the producer append unintended docling flag...

GHSA-RPV3-6645-2VQC Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

org.apache.camel.karaf:camel-docling (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-docling (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-40047 via org.apache.camel:camel-docling (>=4.15.0, <=4.18.2)

org.apache.camel:camel-docling MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.31.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40047 Source advisory: OSV:GHSA-RPV3-6645-2VQC...

org.apache.camel.karaf:camel-docling (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-docling (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-40047 via org.apache.camel:camel-docling (>=4.15.0, <=4.18.2)

org.apache.camel:camel-docling MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.31.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40047 Source advisory: GHSA-RPV3-6645-2VQC...

Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

CVE-2026-40047

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

org.apache.camel.karaf:camel-docling (>=4.18.1, <=4.18.2), org.apache.camel.quarkus:camel-quarkus-docling (>=3.29.0, <=3.33.1) +3 more potentially affected by CVE-2026-40047 via org.apache.camel:camel-docling (>=4.15.0, <=4.18.2)

org.apache.camel:camel-docling MAVEN version =4.15.0, =4.18.1, =3.29.0, =3.29.0, =3.31.0, =4.15.0, =4.18.2 Source cves: CVE-2026-40047 Source advisory: MEND:CVE-2026-40047...

EUVD-2026-41823

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

CVE-2026-40047

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

CVE-2026-40047 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

CVE-2026-40047 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

CVE-2026-40047 Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

CVE-2026-40047

The camel-docling component in Apache Camel (versions 4.15.0 through 4.18.2 ) is vulnerable to Argument Injection (CWE-88) and Path Traversal (CWE-22). The DoclingProducer class fails to sufficiently validate custom CLI arguments provided via the CamelDoclingCustomArguments header before passing ...

CVE-2026-40047: Improper Neutralization of Argument Delimiters in a Command

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through...

PT-2026-55881

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.15.0 through 4.18.2 Description An argument injection issue exists in the Apache Camel Docling component. The component uses java.lang.ProcessBuilder to execute the external docling command-line tool. When custom CLI...

CVE-2026-47214

A flaw was found in Docling, a document processing tool. Its HTML backend contained vulnerabilities related to unsafe handling of Uniform Resource Identifiers URIs and file paths. This could allow an attacker to access local files, navigate outside of intended directories path traversal, and...

CVE-2026-44018

A flaw was found in Docling, a tool for document processing. The METS-GBS backend, responsible for parsing XML and detecting document formats, lacked sufficient security controls. This allowed an attacker to create specially crafted METS-GBS archives. When these archives were processed, they coul...

CVE-2026-47214

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0...

data-prep-toolkit-transforms (>=0.2.1.dev3, <=0.2.1) potentially affected by CVE-2026-47214 via docling (1.11.0)

docling PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on docling and may be impacted: - data-prep-toolkit-transforms =0.2.1.dev3, =0.2.1 Source cves: CVE-2026-47214 Source advisory: OSV:PYSEC-2026-2146...