CVE-2026-78163: Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.
DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encoded and uploaded. Because the exchange body is never filtered by a HeaderFilterStrategy, unlike the Camel header namespace, a sender able to place text in a message that a route forwards into a docling endpoint could reach both sinks without any opt-in from the deployment.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not route message bodies that originate outside the deployment into a docling endpoint, and pass the document through a typed body such as File, byte[] or InputStream, or through the CamelDoclingInputFilePath header, so that the body is never subject to prefix interpretation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.23.0 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.22.1 - Upgrade
Upgrade
Apache Camelto a version that resolves this vulnerability.Fixed in 4.18.5 - Compensating control
For deployments that cannot upgrade immediately, do not route message bodies originating outside the deployment into a docling endpoint. Pass documents through a typed body such as File, byte[] or InputStream, or through the CamelDoclingInputFilePath header, so the body is not subject to prefix interpretation.
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the Apache Camel Docling component are affected in versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.1. Exposure exists where a route passes String message bodies to DoclingProducer and those bodies can contain attacker-influenced content.
What input does an attacker need to provide to trigger remote fetching or local file reads?
A String body beginning with http:// or https:// is treated as a remote URL for Docling to fetch. A body beginning with / or containing a backslash is treated as a local filesystem path; other strings are handled as document content through a temporary file.
Are routes that intend to convert plain text affected?
Yes. The component selected the input mode implicitly from the String body's prefix, with no endpoint option for the route author to restrict it to a single interpretation. Thus, text conversion routes could fetch URLs or read local paths when supplied with specially prefixed text.
Does the size check prevent exploitation?
Not reliably. The size check was performed only when the derived path existed, so paths resolving to nothing or pseudo-files reporting a size of zero could pass the check.