Camel Docling output path header allows arbitrary writes (CVE-2026-95629)
Original title: CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
A low-privileged caller can steer conversion output to an arbitrary directory through an unvalidated header.
Andrea Cosentino disclosed CVE-2026-95629, a path-traversal flaw in Apache Camel's camel-docling component. An unvalidated output path header can direct conversion output into an arbitrary directory. Apache scores it CVSS 3.1 5.4 (medium), with low privileges required. Affected versions are 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2. The notice is truncated and does not mention exploitation.
Unconfirmed: The post is cut off, so the exact header name and write conditions are not fully stated.
- CVSS 3.1 score is 5.4, rated medium.
- Vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
- camel-docling 4.15.0 before 4.18.5 is affected.
- camel-docling 4.19.0 before 4.22.2 is affected.
- Impact is integrity and availability, not confidentiality.
Impact: Write conversion output to an arbitrary directory
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-docling | 4.15.0 before 4.18.5; 4.19.0 before 4.22.2 | 4.18.5 and 4.22.2 |
- 1.Upgrade camel-docling to 4.18.5 or 4.22.2 on the matching release line.
- CVEs
- CVE-2026-95629
- Vendors
- Apache
- Products
- Apache Camelcamel-docling
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95629 | Path Traversal in Apache Camel Docling before 4.18.5 and 4.22.2 | 5.4 | — |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 5. 4 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.