CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
// summary
Apache Camel Docling component has a path traversal vulnerability in versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2, affecting custom CLI argument validation.
// from the source
Posted by Andrea Cosentino on Oct 23 Severity: CVSS 3.1: 5.4 (medium) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L Affected versions: - Apache Camel (org.apache.camel:camel-docling) 4.15.0 before 4.18.5 - Apache Camel (org.apache.camel:camel-docling) 4.19.0 before 4.22.2 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component. This issue affects Apache Camel: from 4.15.0 before...