CVE-2026-95629
Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
02 Description
Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.33% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 26.7% of scored records. A rank, not a probability.
- NVD base score
- 5.4 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- NVD analysis status
- Awaiting Analysis. NVD last modified this record on 2026-10-26.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-10-26 08:44Z3 DAYS AGO
- Last updated
- 2026-10-26 08:44Z3 DAYS AGO
- Reserved
- 2026-09-22
- Assigning CNA
- apache
- Record state
- PUBLISHED
- Severity
- Medium (CVSS 5.4)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weaknesses
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Base
- Data version
- 5.2
- Document digest
- 7e9d27706fc4bbf5660fd6fc40319787957c56848d063b8a92697e60c50e2a7d
05 Affected products
06 References
- camel.apache.orgApache Camel Security Advisory - CVE-2026-95629https://camel.apache.org/security/CVE-2026-95629.html
- issues.apache.orgCAMEL-24894https://issues.apache.org/jira/browse/CAMEL-24894
- github.comFix on main, released in 4.23.0 (commit 48485d408f190c46ef408ba4ba75e45b4e8ffb04)https://github.com/apache/camel/pull/26737
- github.comBackport to camel-4.22.x for 4.22.2 (commit 4f8eb14999163523af6b77d08bfd1b9e79ee49c0)https://github.com/apache/camel/pull/27365
- github.comBackport to camel-4.18.x, released in 4.18.5 (commit 54552df4b9e512cb2025fad22b88429ef0e0169c)https://github.com/apache/camel/pull/27362
- camel.apache.orgCVE-2026-40047, whose custom-argument validation directs callers to the header described herehttps://camel.apache.org/security/CVE-2026-40047.html
- camel.apache.orgCVE-2026-78163, whose fix introduced the inputBaseDirectory option that outputBaseDirectory mirrorshttps://camel.apache.org/security/CVE-2026-78163.html
07 Remediation
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x stream should upgrade to 4.22.2 and users on the 4.18.x stream should upgrade to 4.18.5. The CamelDoclingOutputFilePath header is now normalized before it reaches docling, and a new outputBaseDirectory endpoint option confines it: when the option is set, a value that resolves outside that directory, including an absolute path, is rejected with an IOException before docling is started. The option is unset by default, so it must be set after upgrading wherever the header can carry a value influenced from outside the deployment; without it the header is normalized but can still name any directory. The 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release.