Apache Camel: Path traversal in camel-docling (CVE-2026-95629)
An unvalidated output path header in the Apache Camel camel-docling component allows authenticated attackers to perform path traversal and write converted files to arbitrary directories on the host filesystem.
CVE search metadata
CVE search record: CVE-2026-95629. KEV: no. Product: Apache Camel (4.15.0 <= version < 4.18.5), Apache Camel (4.19.0 <= version < 4.22.2). Brief: Apache Camel: Path traversal in camel-docling (CVE-2026-95629). Brief link: https://feed.craftedsignal.io/briefs/2026-10-apache-camel-docling-traversal/
Triage facts
Revision 1- Applicability
- Apache Camel (4.15.0 <= version < 4.18.5), Apache Camel (4.19.0 <= version < 4.22.2)
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 14:58 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Apache Camel versions using the camel-docling component (4.15.0 to 4.18.4 and 4.19.0 to 4.22.1) are vulnerable to a path traversal issue (CVE-2026-95629). An authenticated user can supply a crafted output path header to manipulate where the component writes converted file outputs, potentially leading to unauthorized file overwrites or service disruption.
Impact
Successful exploitation allows an authenticated attacker to write files outside of the intended directory. This can lead to unauthorized file modification, potential corruption of critical system files, or denial of service by overwriting application-specific configuration or binary files.
Recommendation
- Upgrade Apache Camel camel-docling to version 4.18.5 or later for the 4.15.x branch.
- Upgrade Apache Camel camel-docling to version 4.22.2 or later for the 4.19.x branch.
- Audit application logs for abnormal file system write operations originating from the camel-docling service process if patching cannot be performed immediately.
Immediate actions
Upgrade Apache Camel camel-docling to version 4.18.5 or 4.22.2.
Threat Hunt
Hunt for file creation events originating from the application service process that target sensitive directories outside the expected output folder.
Data: Application audit logs or file system monitoring (e.g., Sysmon Event ID 11)
Mitigations
Apply security patches or upgrade to the non-vulnerable versions.
CVE-2026-95629