CVE-2026-95629 Apache Software Foundation CVE debrief

Who should care

Defenders and developers using Apache Camel versions 4.15.0 to 4.22.2 should assess exposure and apply patches or upgrades. Ensure that the CamelDoclingOutputFilePath header is validated and limited to prevent directory traversal attacks.

Why it matters

CVE-2026-95629 is a Path Traversal vulnerability in Apache Camel Docling component. Defenders should care because it allows potential unauthorized file writes and data integrity issues. Required actions include validating and limiting headers, and applying patches or upgrades.

• Potential unauthorized file writes
• Possible data integrity issues
• Required validation and limitation of headers
• Need for timely patching or upgrades

Technical summary

The vulnerability allows an attacker to write conversion output to any directory the Camel process can write to, by manipulating the CamelDoclingOutputFilePath header. This issue affects Apache Camel versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2. The vulnerability allows potential unauthorized file writes and data integrity issues. Defenders should validate and limit headers, and apply patches or upgrades. Users are recommended to upgrade to version 4.23.0 or apply patches to affected versions. The fix adds an outputBaseDirectory endpoint option that is unset by default, so after upgrading, set it on every docling endpoint whose CamelDoclingOutputFilePath header can carry a value influenced

Defensive priority

Medium

Recommended defensive actions

• Upgrade to Apache Camel version 4.23.0 or later
• Apply patches to affected versions (4.18.5 or 4.22.2)
• Validate and limit the CamelDoclingOutputFilePath header
• Review and adjust the outputBaseDirectory endpoint option
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, affected versions, and recommended patches. Apache Camel security advisories offer additional context. The vulnerability allows potential unauthorized file writes and data integrity issues. Defenders should validate and limit headers, and apply patches or upgrades. The issue affects Apache Camel versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2. Users are recommended to upgrade to version 4.23.0 or apply patches to affected versions. The CVE- 6

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.