Camel Docling still accepts absolute CLI paths (CVE-2026-95628)
Original title: CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
Path checks added after CVE-2026-40047 do not reject absolute paths supplied as custom CLI arguments.
Andrea Cosentino reported CVE-2026-95628 in Apache Camel camel-docling. Custom CLI argument path validation does not reject absolute paths, leaving a path-traversal issue described as an incomplete fix of CVE-2026-40047. CVSS 3.1 is 5.4 (medium), and low privileges are required. Affected releases are 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2. The truncated post does not say the flaw is exploited.
Unconfirmed: The notice is truncated, so how absolute paths bypass the earlier fix is not fully described.
- CVSS 3.1 score is 5.4, rated medium.
- Vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.
- Described as an incomplete fix of CVE-2026-40047.
- Same camel-docling ranges as the related Docling advisory: before 4.18.5 and 4.22.2.
Impact: Path traversal via absolute custom CLI argument paths
| Product | Affected | Fixed in |
|---|---|---|
| Apache Camel camel-docling | 4.15.0 before 4.18.5; 4.19.0 before 4.22.2 | 4.18.5 and 4.22.2 |
- 1.Upgrade camel-docling to 4.18.5 or 4.22.2 on the matching release line.
- CVEs
- CVE-2026-95628
- Vendors
- Apache
- Products
- Apache Camelcamel-docling
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-95628 | Path Traversal in Apache Camel Docling before 4.23.0 | 5.4 | — |
From the original article
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3. 1: 5. 4 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.