CVE-2026-40047: Apache Camel Path Traversal Vulnerability

CVE-2026-40047 Overview

CVE-2026-40047 is an argument injection vulnerability in the Apache Camel camel-docling component. The flaw affects Apache Camel releases from 4.15.0 before 4.18.3. The DoclingProducer assembles command-line arguments for the external docling tool and executes them through java.lang.ProcessBuilder. Values supplied via the CamelDoclingCustomArguments exchange header were appended with insufficient validation, relying on a denylist of flags and a literal ../ check for path values.

Critical Impact
Externally-influenced Camel routes can inject unintended docling CLI flags and traversal-based paths, allowing attackers to alter subprocess behavior and access files outside the intended directory [CWE-88].

Affected Products

Apache Camel 4.15.0 through 4.18.2
Apache Camel 4.18.x LTS stream prior to 4.18.3
Apache Camel mainline releases prior to 4.19.0

Discovery Timeline

2026-07-06 - CVE-2026-40047 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-40047

Vulnerability Analysis

The camel-docling component invokes the external docling command-line tool. DoclingProducer builds an argument list and passes it to java.lang.ProcessBuilder in list form. Because ProcessBuilder receives a list, no shell interprets the arguments, so classic OS command injection through shell metacharacters is not possible. However, the component treats the argument vector as a trust boundary that the CLI itself must enforce.

Custom arguments arriving through the CamelDoclingCustomArguments header (a List<String>) were validated using a denylist of disallowed flags. Any flag not on the denylist was forwarded to docling unchanged. Path-bearing headers were checked only for the literal substring ../, missing normalized or encoded traversal sequences.

Root Cause

The root cause is weak input validation in the producer. A denylist cannot enumerate every unsafe docling flag, and a substring check for ../ fails against traversal sequences that require path normalization to detect. The component is responsible for constraining values it feeds into the subprocess, and the original checks did not meet that responsibility [CWE-88].

Attack Vector

An attacker who can influence message content that a Camel route maps into CamelDoclingCustomArguments or into the path-bearing headers can inject unrecognized docling CLI flags or supply argument values that resolve outside the intended directory. Exploitation requires no authentication when a network-facing route forwards untrusted input into these headers. The impact includes altered docling invocation behavior and directory traversal in file arguments passed to the subprocess.

No verified public exploit code is available. See the Apache Camel CVE-2026-40047 Advisory and the OpenWall OSS-Security Discussion for technical details.

Detection Methods for CVE-2026-40047

Indicators of Compromise

Camel exchange messages arriving from external producers that contain CamelDoclingCustomArguments headers or Camel-internal path headers.
docling subprocess invocations logged with unrecognized CLI flags or with file paths that resolve outside the configured working directory.
Traversal sequences in docling argument values, including encoded or non-literal forms that bypass a plain ../ check.

Detection Strategies

Inventory Camel deployments and identify routes that consume from untrusted transports and feed data into camel-docling.
Audit route definitions for uses of setHeader("CamelDoclingCustomArguments", ...) or expressions that copy inbound headers directly onto the exchange.
Instrument the JVM or wrap ProcessBuilder invocations to capture the full argument vector passed to docling for offline review.

Monitoring Recommendations

Forward Camel application logs and subprocess execution telemetry to a centralized data lake for correlation and retention.
Alert on docling processes spawned with arguments referencing directories outside the intended output path.
Track upgrades of the camel-docling artifact across build pipelines to confirm patched versions reach production.

How to Mitigate CVE-2026-40047

Immediate Actions Required

Upgrade Apache Camel to 4.18.3 on the 4.18.x LTS stream, or to 4.19.0 or later on the mainline (for example, 4.20.0), which include the CAMEL-23212 fix.
Remove or restrict routes that map externally-influenced content into CamelDoclingCustomArguments or path-bearing headers.
Strip Camel-internal headers from messages arriving from untrusted producers using removeHeaders("Camel*") or an equivalent processor.

Patch Information

The CAMEL-23212 fix replaces the denylist with a strict allowlist of recognized docling CLI flags, rejects producer-managed flags such as output-directory options, defensively rejects shell metacharacters in argument values, and normalizes path-like values with Path.normalize() before validation. Full details are available in the Apache Camel CVE-2026-40047 Advisory.

Workarounds

Validate and sanitize any header value on the allowlist before it reaches camel-docling, rejecting unknown flags and normalizing path values with Path.normalize().
Isolate the docling subprocess by running the Camel worker with a dedicated low-privilege OS account and a constrained working directory.
Apply network controls so that only trusted producers can reach Camel endpoints feeding the camel-docling component.

bash

# Example: strip Camel-internal headers from untrusted inbound messages
# Route DSL fragment (Java)
from("jetty:http://0.0.0.0:8080/ingest")
    .removeHeaders("Camel*")
    .removeHeader("CamelDoclingCustomArguments")
    .to("docling:convert");