CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

As cited

Copy frozen at 2026-10-23 15:37 UTC (site build).

vulnerabilities

CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

Apache Camel's Docling component fails to properly validate file paths in custom CLI arguments, allowing path traversal attacks via absolute paths. This is an incomplete fix of an earlier vulnerability, CVE-2026-40047. Affected versions span from 4.15.0 to 4.18.4 and from 4.19.0 to 4.22.1.

Why it matters: Organizations using Apache Camel Docling in the affected versions face integrity and availability risks from authenticated attackers who can traverse directories and manipulate files; patch to 4.18.5, 4.22.2, or later.

Source published

2026-10-23 13:18 UTC

First seen by Cybersecurity Tracker

2026-10-23 14:50 UTC