Apache Camel (4.15.0 <= Version < 4.18.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/apache-camel-4.15.0--version--4.18.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 14:58:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Camel: Path traversal in camel-docling (CVE-2026-95629)https://feed.craftedsignal.io/briefs/2026-10-apache-camel-docling-traversal/Fri, 23 Oct 2026 14:58:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-camel-docling-traversal/An unvalidated output path header in the Apache Camel camel-docling component allows authenticated attackers to perform path traversal and write converted files to arbitrary directories on the host filesystem.Apache Camel versions using the camel-docling component (4.15.0 to 4.18.4 and 4.19.0 to 4.22.1) are vulnerable to a path traversal issue (CVE-2026-95629). An authenticated user can supply a crafted output path header to manipulate where the component writes converted file outputs, potentially leading to unauthorized file overwrites or service disruption.

Impact

Successful exploitation allows an authenticated attacker to write files outside of the intended directory. This can lead to unauthorized file modification, potential corruption of critical system files, or denial of service by overwriting application-specific configuration or binary files.

Recommendation

  • Upgrade Apache Camel camel-docling to version 4.18.5 or later for the 4.15.x branch.
  • Upgrade Apache Camel camel-docling to version 4.22.2 or later for the 4.19.x branch.
  • Audit application logs for abnormal file system write operations originating from the camel-docling service process if patching cannot be performed immediately.
]]>mediumadvisory