Command Injection Vulnerability in Apache Camel Docling Component
CVE-2026-40047

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Camel
Vendor
CVE Published:
6 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-40047?

A command injection vulnerability exists in the Apache Camel Docling component due to improper validation of custom CLI arguments. The vulnerability arises when the DoclingProducer constructs an argument list for the external 'docling' command-line tool, where insufficient validation may allow an attacker to inject unrecognized or unintended CLI flags. This occurs because the existing denylist mechanism fails to block path-like values effectively. Attackers could leverage this flaw to execute commands that traverse outside permitted directories, posing a risk of unauthorized access. Users are advised to upgrade to version 4.19.0 or later to incorporate a fix that employs a strict allowlist for CLI flags and enhances argument validation.

Affected Version(s)

Apache Camel 4.15.0 < 4.18.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-40047
Created by oscerd

References

https://camel.apache.org/security/CVE-2026-40047.html
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Cosentino from Apache Software Foundation
Andrea Cosentino from Apache Software Foundation
.