CVE-2026-40047
published 2026-07-06CVE-2026-40047: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component…
PriorityP262critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.78%
76.0th percentile
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.
The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through the `CamelDoclingCustomArguments` exchange header (a List) were appended to that argument list with insufficient validation: the original implementation relied on a denylist of disallowed flags and only rejected path values that contained a literal `../` sequence. As a result, a Camel route that forwards externally-influenced data into the `CamelDoclingCustomArguments` header (or into the path-bearing headers used to build the invocation) could cause the producer to pass unrecognized or unintended `docling` CLI flags to the subprocess, and could supply path-like argument values that resolved outside the intended directory through traversal sequences not caught by the literal `../` check. Because Camel itself builds the `docling` invocation from these values, the component is responsible for constraining them, and the weak validation allowed CLI-argument injection and directory traversal in the arguments passed to the external tool. The invocation uses the list-based form of ProcessBuilder, so a shell does not interpret the argument values; OS command injection through shell metacharacters was not possible, and the metacharacter rejection added by the fix is defense-in-depth.
This issue affects Apache Camel: from 4.15.0 before 4.18.3.
Users are recommended to upgrade to a release that contains the CAMEL-23212 fix. On the mainline the fix is included from Apache Camel 4.19.0 (and later releases such as 4.20.0). For users on the 4.18.x LTS releases stream, upgrade to 4.18.3. The fix replaces the denylist with a strict allowlist of recognized `docling` CLI flags (rejecting any unrecognized flag, and rejecting producer-managed
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | camel | >= 4.15.0 < 4.18.3 | 4.18.3 |
| apache_software_foundation | apache_camel | >= 4.15.0 < 4.18.3 | 4.18.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for abuse of the CamelDoclingCustomArguments exchange header — attacker-controlled values injected here are the primary attack vector for CLI argument injection against the docling subprocess. ↗
- →Detect path traversal attempts in argument values that do NOT contain a literal `../` sequence (e.g., URL-encoded or double-encoded traversal sequences), as the original denylist only blocked the literal string. ↗
- →Alert on Camel routes where the CamelDoclingCustomArguments header is populated from inbound HTTP messages — this is the exploitation path described by Red Hat. ↗
- →Look for unexpected or unrecognized flags being passed to the `docling` CLI subprocess spawned by DoclingProducer via java.lang.ProcessBuilder — these indicate argument injection. ↗
- →Audit process creation events for `docling` child processes spawned by a JVM (java.lang.ProcessBuilder) with suspicious or unexpected argument lists, particularly those containing path-like values. ↗
- →Flag any inbound messages to a Camel docling route that carry Camel-internal headers (e.g., CamelDocling* headers) from untrusted producers — these should be stripped before reaching the producer. ↗
- ·The vulnerability affects Apache Camel versions 4.15.0 through before 4.18.3 only; versions 4.18.3+ and 4.19.0+ are patched. ↗
- ·OS command injection via shell metacharacters is NOT possible because ProcessBuilder's list-based invocation bypasses shell interpretation; detections should focus on argument injection and path traversal, not shell metacharacter abuse. ↗
- ·As an interim mitigation for unpatched deployments, strip the CamelDoclingCustomArguments header from inbound HTTP messages before the docling producer using removeHeaders('CamelDocling*') at the start of the route. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.
ghsa_unreviewed·2026-07-06
CVE-2026-40047 [CRITICAL] CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.
The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through the `CamelDoclingCustomArguments` exchange header (a List) were appended to that argument list with insufficient validation: the original implementation relied on a denylist of disallowed flags and only rejected path values that contained a literal `../` sequence. As a result, a Camel route that forwards externally-influenced data into the `CamelDoclingCustomArguments` header (or into the path-bearing headers used to build the invocation) could ca
VulDB
Apache Camel up to 4.18.2 Camel-Docling path traversal
vuldb·2026-07-05
CVE-2026-40047 [CRITICAL] Apache Camel up to 4.18.2 Camel-Docling path traversal
A vulnerability was found in Apache Camel up to 4.18.2. It has been declared as critical. This impacts an unknown function of the component Camel-Docling. Executing a manipulation can lead to path traversal.
This vulnerability is handled as CVE-2026-40047. It is possible to launch the attack on the local host. There is not any exploit available.
It is recommended to upgrade the affected component.
Red Hat
camel-docling: Apache Camel Docling: CLI argument injection and path traversal
vendor_redhat·2026-07-06·CVSS 9.1
CVE-2026-40047 [CRITICAL] CWE-78 camel-docling: Apache Camel Docling: CLI argument injection and path traversal
camel-docling: Apache Camel Docling: CLI argument injection and path traversal
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.
The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.ProcessBuilder. Custom CLI arguments supplied through the `CamelDoclingCustomArguments` exchange header (a List) were appended to that argument list with insufficient validation: the original implementation relied on a denylist of disallowed flags and only rejected path values that contained a literal `../` sequence. As a result, a Camel route that forwards externally-influenced data into the `CamelDoclingCustomArguments`
No detection rules found.
No public exploits indexed.
2026-07-06
Published