CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

As cited

Copy frozen at 2026-10-23 15:37 UTC (site build).

vulnerabilities

CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

CVE-2026-95629 is a path traversal vulnerability in Apache Camel's Docling component that allows authenticated users to write conversion output to arbitrary directories by manipulating an output path header. The vulnerability affects versions 4.15.0 through 4.18.4 and 4.19.0 through 4.22.1, with a CVSS score of 5.4 (medium).

Why it matters: Apache Camel users running affected Docling versions should upgrade immediately, as authenticated attackers can exploit this to write files outside intended directories and potentially compromise system integrity.

Source published

2026-10-23 13:20 UTC

First seen by Cybersecurity Tracker

2026-10-23 14:50 UTC