CVE-2026-95628
Camel-Docling: Custom CLI argument path validation does not reject absolute paths (incomplete fix of CVE-2026-40047)
Description
DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose flags the fix for CVE-2026-40047 restricted to an allowlist. That fix also introduced validatePathSafety to keep path-like argument values inside the intended directory, but the method only looked for relative traversal: it rejected a value containing a traversal sequence such as ../ and a value whose normalized form still held a .. element. It never checked whether a value was an absolute path, and an absolute path without traversal segments contains neither, so it passed unchanged. Every path-like value went through this check, whether it was a separate list element following its flag or was attached to the flag after an equals sign, so an absolute path was accepted in either form, for example as the directory given to the allowlisted --artifacts-path flag, which tells docling where to find its model artifacts. Such a value reached the docling command line as given, so a party able to choose the custom arguments could point the docling process at any directory the Camel process can access, outside the working directory that the check was meant to keep path values in, which is the outcome the CVE-2026-40047 fix set out to prevent. Only the CLI mode, which is the default, passes custom arguments to docling. The header belongs to the Camel header namespace, which consumers applying Camel's default header filtering, such as the JMS and Kafka consumers, remove from incoming messages, so the issue is reached where a route forwards externally influenced values into the header or where a consumer maps incoming headers without that filtering.
Mitigation
Credit
This issue was discovered by Zhixi "Jace" Sun, independent security researcher
Notes
The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24893 refers to the commits that resolved the issue, and has more details.
The fix was merged on main in https://github.com/apache/camel/pull/26738 (commit fd3bc8e73613f3aec691044ed07869ef79c1bf2f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26743 (commit e9233c37c6127221157ac0901fb74250c5d24e98) and to camel-4.18.x in https://github.com/apache/camel/pull/26744 (commit 59d30af17064320073e17cfb516be60d096bb979).
The validatePathSafety helper now also rejects a path-like custom-argument value that is an absolute path, failing the exchange with an IllegalArgumentException stating that the argument must not be an absolute path. Because the check sits in the shared helper that validates every path-like value, whether it is a separate list element following its flag or is attached to the flag after an equals sign, it covers every path-valued flag on the allowlist rather than only the one that locates the docling model artifacts. A relative value without traversal segments is still accepted, and docling resolves it against its own working directory, which can be set with the workingDirectory endpoint option, so a route that passed an absolute path in a custom argument must pass a relative one instead.
Custom-argument values have never been checked for absolute paths. From its introduction in 4.15.0, camel-docling appended them to the docling command without any validation; a check added in 4.18.1 then refused the output flags and a literal ../ sequence, and the CVE-2026-40047 fix, released in 4.18.3 and 4.19.0, replaced that check with the allowlist and validatePathSafety. None of these versions rejected an absolute path, so the affected range starts at 4.15.0 rather than at the release that introduced validatePathSafety, and releases before 4.18.3 and 4.19.0 are affected by CVE-2026-40047 as well.
This advisory is an incomplete-fix follow-on to CVE-2026-40047 (CAMEL-23212), whose fix introduced validatePathSafety to keep path-like custom-argument values from leaving the intended directory but only checked for relative traversal, so deployments that upgraded to 4.18.3 or 4.19.0 in response to that advisory remained exposed to absolute values. The CamelDoclingOutputFilePath header, which the custom-argument validation names as the way to choose the output directory, is not a custom argument and was not covered by this change; a separate gap in its handling was fixed in the same releases and is covered by a separate advisory. This issue is also distinct from CVE-2026-78163, which concerned how the same producer interpreted a String message body as an input location. It is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).