Description
Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.



This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.



DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encoded and uploaded. Because the exchange body is never filtered by a HeaderFilterStrategy, unlike the Camel header namespace, a sender able to place text in a message that a route forwards into a docling endpoint could reach both sinks without any opt-in from the deployment.



Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not route message bodies that originate outside the deployment into a docling endpoint, and pass the document through a typed body such as File, byte[] or InputStream, or through the CamelDoclingInputFilePath header, so that the body is never subject to prefix interpretation.
Published: 2026-10-19
Score: 5.9 Medium
EPSS: n/a
KEV: No
Impact: Server‑side request forgery and local file disclosure via untrusted message bodies
Action: Patch Immediately
AI Analysis

Impact

Apache Camel's Docling component interprets the prefix of a message body to decide whether to fetch a remote URL, read a local file, or treat the content as a temporary document. Because no endpoint option pins this behavior and the decision is made solely on the first characters, a crafted body can cause the component to request arbitrary remote servers or read files from the host filesystem. This flaw leads to server‑side request forgery, potential path‑traversal‑style local file disclosure, and exposure of sensitive information to untrusted actors. The vulnerability is scoped to routes that forward message bodies to a Docling endpoint, and the component performs only a minimal size check before accessing the derived resource.

Affected Systems

The issue affects Apache Camel versions 4.15.0 through 4.18.4, 4.19.0 through 4.21.x, and 4.22.0 through 4.22.0 (before 4.22.1). Users on the 4.18.x release stream should upgrade to 4.18.5, and those on the 4.22.x stream should move to 4.22.1. The 4.23.0 release contains the official fix, while the 4.14.x stream and earlier are end-of-life and will not receive a patch.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity; the vulnerability can be abused when an attacker can inject message bodies into a Camel route that targets a Docling endpoint. Because the request originates internally, the attack requires access to the Camel messaging flow, but no extra authentication is needed. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, suggesting that it is not currently a widely exposed exploited vulnerability. Nonetheless, the possibility of remote fetches or local file reads makes it a significant concern for deployments that expose Docling routes to external traffic.

Generated by OpenCVE AI on October 19, 2026 at 11:51 UTC.

Remediation

Vendor Solution

Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.22.x stream should upgrade to 4.22.1 and users on the 4.18.x stream should upgrade to 4.18.5. The 4.14.x stream and earlier reached end of life before this issue was resolved and will not receive a fix.

Vendor Workaround

Do not route message bodies originating outside the deployment into a docling endpoint. Pass the document through a typed body such as File, byte[] or InputStream, or through the CamelDoclingInputFilePath header, so that the body is not subject to prefix interpretation.

OpenCVE Recommended Actions

  • Upgrade Apache Camel to version 4.23.0 (or to 4.22.1 if remaining on the 4.22.x stream, and to 4.18.5 if on the 4.18.x stream).
  • If an immediate upgrade is not possible, do not route message bodies originating outside the deployment into a Docling endpoint; instead, pass the document through a typed body such as File, byte[] or InputStream, or set the CamelDoclingInputFilePath header to prevent prefix interpretation.
  • Add explicit validation in the Camel route to enforce a whitelist of acceptable URL prefixes or content types before passing data to a docling endpoint.

Generated by OpenCVE AI on October 19, 2026 at 11:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Description Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encoded and uploaded. Because the exchange body is never filtered by a HeaderFilterStrategy, unlike the Camel header namespace, a sender able to place text in a message that a route forwards into a docling endpoint could reach both sinks without any opt-in from the deployment. Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not route message bodies that originate outside the deployment into a docling endpoint, and pass the document through a typed body such as File, byte[] or InputStream, or through the CamelDoclingInputFilePath header, so that the body is never subject to prefix interpretation.
Title Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
Weaknesses CWE-200
CWE-22
CWE-918
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-19T10:07:06.939Z

Reserved: 2026-08-23T12:48:57.941Z

Link: CVE-2026-78163

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T11:17:19.233

Modified: 2026-10-19T11:17:19.233

Link: CVE-2026-78163

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:00:16Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-918

    Server-Side Request Forgery (SSRF)