Path Traversal Vulnerability in Apache Camel Docling Component

CVE-2026-95628

What is CVE-2026-95628?

A Path Traversal vulnerability exists in the Apache Camel Docling component, allowing external entities to influence command-line arguments. This flaw arises because the method intended to sanitize path-like arguments only checks for relative traversal, leaving absolute paths unverified. As a result, unauthorized users can direct the Docling process to access any directory accessible by the Camel process, potentially compromising sensitive data. Users are encouraged to upgrade to Apache Camel version 4.23.0 or specific patched versions for earlier releases to mitigate this issue. In cases where immediate upgrades aren't feasible, it's recommended to avoid using untrusted input for the CamelDoclingCustomArguments header and ensure proper header filtering is implemented.

References