Medium [CVE-2026-40047] CLI argument injection and path traversal
This medium-severity Red Hat Linux advisory covers CVE-2026-40047 affecting Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-line tool by assembling an argument list in DoclingProducer and executing it through java.lang.
ProcessBuilder. Custom CLI arguments supplied through the `CamelDoclingCustomArguments` exchange header (a List) were appended to that argument list with insufficient validation: the original implementation relied on a denylist of disallowed flags and only rejected path values that contained a literal `../` sequence.
As a result, a Camel route that forwards externally-influenced data into the `CamelDoclingCustomArguments` header (or into the path-bearing headers used to build the invocation) could cause the producer to pass unrecognized or unintended `docling` CLI flags to the subprocess, and could supply path-like argument values that resolved outside the intended directory through traversal sequences not caught by the literal `../` check.
Because Camel itself builds the `docling` invocation from these values, the component is responsible for constraining them, and the weak validation allowed CLI-argument injection and directory traversal in the arguments passed to the external tool. This issue affects Apache Camel: from 4.15.0 before 4.18.3.
- < 4.15.0
- < 4.18.3
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
- 4.18
- 4.18.3
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Mitigation checklist
- For deployments that cannot upgrade immediately, strip the CamelDoclingCustomArguments header from inbound HTTP messages before the docling producer (for example removeHeaders('CamelDocling*') at the start of the route). Additionally, restrict HTTP endpoint access with authentication.
Official advisory · high-confidence parse· fetched 11 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.