Loading vulnerability…
Path Traversal in Apache Camel Docling Output Directory Handling
CVE-2026-95629 is a path traversal vulnerability in the Apache Camel Docling component affecting versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2. In CLI mode, which is the default, DoclingProducer's addOutputDirectoryArguments method passes the CamelDoclingOutputFilePath header directly to the external docling tool's output-directory argument without normalization or directory confinement. Absolute paths and parent-directory traversal segments are accepted, allowing a party controlling the header to direct converted documents into any directory writable by the Camel process. Files written outside the producer's temporary directory remain after cleanup. The docling-serve mode does not use this header and is unaffected by this issue.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized placement of document-conversion output in directories writable by the Camel process, with potential integrity and availability impacts. Output consists of Markdown, HTML, JSON, or text generated from the input document; the attacker can influence its content through the document but cannot directly specify arbitrary output bytes. Output filenames derive from input filenames; documents supplied through the message body receive random temporary names that carry over to the output. Arbitrary code execution and confidentiality loss are not established.
If you can’t patch tonight, do this now.
Prevent externally supplied values from populating CamelDoclingOutputFilePath. Remove this header from externally sourced messages before they reach a Docling endpoint, and ensure consumers mapping incoming message headers filter the Camel header namespace. Only trusted route logic should select the output directory. Consumers using Camel's default header filtering, including JMS and Kafka consumers, already remove incoming Camel-namespace headers unless route logic subsequently reintroduces externally influenced values.
Patch, then assume compromise.
Upgrade to Apache Camel 4.23.0, or to 4.22.2 or 4.18.5 on the corresponding supported release streams. After upgrading, explicitly configure outputBaseDirectory on every Docling endpoint whose CamelDoclingOutputFilePath header can be externally influenced. The fix normalizes the header and, when outputBaseDirectory is configured, rejects paths resolving outside that directory before launching docling. Upgrading alone does not enforce confinement because outputBaseDirectory is unset by default. Affected release lines 4.15.x–4.17.x and 4.19.x–4.21.x are end of life and require migration to a supported release.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.