Critical, CVSS 9.1MavenPublished
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
CVE-2026-40047 · GHSA-rpv3-6645-2vqc
- Affected
- Maven org.apache.camel:camel-docling >= 4.15.0, < 4.18.3
- Fixed in
- 4.18.3· Vendor fix available
- Issue
- Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external docling command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through the CamelDoclingCustomArguments exchange header (a List<String) were appended to that argument list with insufficient validation: the original implementation relied on a denylist of disallowed flags and only rejected path values that contained a literal ../ sequence. As a result, a Camel route that forwards externally-influenced data into the CamelDoclingCustomArguments header (or into the path-bearing headers used to build the invocation) could cause the producer to pass unrecognized or unintended docling CLI flags to the subprocess, and could supply path-like argument values that resolved outside the intended directory through traversal…
Recommended action: Upgrade to 4.18.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.