Apache Camel Docling vulnerabilities

A path traversal vulnerability in the Apache Camel Docling component allows the conversion output file to be written to any directory writable by the Camel process. The CamelDoclingOutputFilePath header value is passed without normalization or confinement to a base directory, letting an attacker influence the output location.

A path traversal vulnerability in the Apache Camel Docling component allows an absolute path supplied in the CamelDoclingCustomArguments header to bypass the validatePathSafety check, which only rejects relative traversal sequences such as ../. As a result, a party able to control these arguments can point the docling process at any directory accessible to the Camel process, outside the intended working directory. The issue affects versions 4.15.0–4.18.4 and 4.19.0–4.22.1 and is fixed in 4.23.0, 4.22.2, and 4.18.5.

A vulnerability in the Apache Camel Docling component allows implicit selection of message body processing mode based on its prefix (http://, https://, / or \), enabling SSRF, path traversal and exposure of sensitive information. The lack of an option to pin the mode and insufficient path validation allow access to remote resources or local files without deployment opt-in.