{"id":"CVE-2026-78163","kind":"vulnerability","aliases":["CVE-2026-78163"],"related":[],"title":"Apache Camel Docling: string body lets senders fetch URLs or read files","description":"Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.\n\n\n\nThis issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.\n\n\n\nDoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encoded and uploaded. Because the exchange body is never filtered by a HeaderFilterStrategy, unlike the Camel header namespace, a sender able to place text in a message that a route forwards into a docling endpoint could reach both sinks without any opt-in from the deployment.\n\n\n\nUsers are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.1. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.14.x releases stream and earlier reached end of life before this issue was resolved and will not receive a fix, so deployments on those lines must move to a supported release. For deployments that cannot upgrade immediately, do not route message bodies that originate outside the deployment into a docling endpoint, and pass the document through a typed body such as File, byte[] or InputStream, or through the CamelDoclingInputFilePath header, so that the body is never subject to prefix interpretation.","summary":"The Docling component in Apache Camel treats a String message body as a URL, a local file path or document text based on its prefix. A sender who controls text in a message forwarded into a Docling endpoint can make the server fetch remote resources or read local files.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-camel","docling","java","package","self-hosted"],"not_affected_if":["external-input-not-routed","no-docling-endpoint","typed-body-input"],"how_to_check":"- Search route definitions for Docling endpoints (camel-docling component) that receive message bodies from outside the deployment\n- Check the Camel version in use, for example with `mvn dependency:tree | grep camel-docling`\n- Confirm whether a route sends String bodies, not File, byte[] or InputStream, into a docling endpoint","fix":"- Upgrade Apache Camel to `4.23.0`\n- If on the 4.22.x stream, upgrade to `4.22.1`\n- If on the 4.18.x stream, upgrade to `4.18.5`\n- Until upgraded, stop routing external message bodies into docling endpoints and pass documents as File, byte[] or InputStream, or via the CamelDoclingInputFilePath header","status":"open","published_at":"2026-10-19T11:17:19+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:08:53+00:00","updated_at":"2026-10-25T04:08:53+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:08:53Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Camel to `4.23.0`\n- If on the 4.22.x stream, upgrade to `4.22.1`\n- If on the 4.18.x stream, upgrade to `4.18.5`\n- Until upgraded, stop routing external message bodies into docling endpoints and pass documents as File, byte[] or InputStream, or via the CamelDoclingInputFilePath header","reach":"network","title":"Apache Camel Docling: string body lets senders fetch URLs or read files","impact":"medium","summary":"The Docling component in Apache Camel treats a String message body as a URL, a local file path or document text based on its prefix. A sender who controls text in a message forwarded into a Docling endpoint can make the server fetch remote resources or read local files.","category":"package","nicknames":[],"who_cares":["apache-camel","java","docling","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"server fetches attacker-chosen URLs or reads local files","analyst_note":"","how_to_check":"- Search route definitions for Docling endpoints (camel-docling component) that receive message bodies from outside the deployment\n- Check the Camel version in use, for example with `mvn dependency:tree | grep camel-docling`\n- Confirm whether a route sends String bodies, not File, byte[] or InputStream, into a docling endpoint","needs_analyst":false,"not_affected_if":["typed-body-input","no-docling-endpoint","external-input-not-routed"],"who_is_affected":"Applications using Apache Camel's Docling component from 4.15.0 before 4.18.5, and from 4.19.0 before 4.22.1, where a route forwards a String body that an outside sender can influence into a Docling endpoint. Releases 4.14.x and earlier are end of life and receive no fix. Routes that pass typed bodies or use the file path header are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4052,"output_tokens":693,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-78163':15A,18A '4.14':422C '4.15.0':115C '4.18':409C '4.18.5':117C,420C '4.19.0':119C '4.22':392C '4.22.1':121C,403C '4.23.0':382C 'abl':348C 'actor':102C 'affect':111C 'allow':186C 'anyth':164C 'apach':1A,20B,32B,105C,112C 'apache-camel':19B 'append':289C 'appli':237C 'argument':296C 'arriv':206C 'author':189C 'backend':314C 'backslash':156C 'base':49B 'base64':327C 'base64-encoded':326C 'becam':211C 'begin':228C 'bodi':5A,38B,128C,135C,150C,209C,334C,464C,481C,496C 'byte':485C 'call':280C 'camel':2A,21B,33B,106C,113C,343C 'cameldoclinginputfilepath':491C 'cannot':457C 'check':245C,248C,276C 'chosen':180C 'cli':287C 'compon':30B,108C,193C 'contain':154C 'content':176C,323C 'control':56B 'convert':173C,203C 'could':324C,363C 'cve':13A,16A 'decid':123C 'deploy':374C,444C,455C,469C 'deriv':240C 'directori':91C 'docl':3A,22B,29B,64B,107C,142C,299C,304C,361C,472C 'docling-serv':303C 'doclingproduc':122C 'document':47B,175C,477C 'earlier':427C 'either':309C 'els':165C 'encod':328C 'end':429C 'endpoint':65B,184C,362C,473C 'exchang':333C 'exist':253C 'exposur':95C 'fetch':8A,70B,148C,316C 'fetcher':213C 'file':12A,44B,76B,171C,222C,267C,484C 'files.readallbytes':319C 'filesystem':162C 'filter':337C 'final':294C 'five':279C 'fix':384C,442C 'forgeri':81C 'forward':61B,358C 'guard':236C 'hand':140C 'happen':226C 'header':344C,492C 'headerfilterstrategi':340C 'host':27B 'httpsourc':311C 'immedi':459C 'implicit':181C 'improp':83C 'inform':98C 'inputstream':487C 'inspect':131C 'interpret':197C,502C 'issu':110C,386C,434C 'java':23B 'let':6A 'life':431C 'limit':84C 'line':447C 'local':43B,75B,161C,221C 'make':67B 'mean':202C 'meant':129C 'messag':37B,60B,127C,354C,463C 'mode':178C,288C,306C 'move':449C 'must':448C 'namespac':345C 'never':336C,498C 'noth':261C 'one':230C 'opt':370C 'opt-in':369C 'option':185C 'origin':466C 'outsid':467C 'packag':24B 'pass':273C,307C,475C 'path':45B,92C,257C 'pathnam':87C 'pin':191C 'place':350C 'posit':295C 'prefix':52B,133C,233C,501C 'pseudo':266C 'pseudo-fil':265C 'reach':282C,364C,428C 'read':11A,74B,158C 'reader':219C 'receiv':440C 'recommend':377C 'releas':394C,411C,424C,453C 'remot':71B,145C,215C 'report':268C 'request':80C 'resolv':259C,436C 'resourc':72B,216C 'restrict':90C 'rout':188C,200C,357C,462C 'self':26B 'self-host':25B 'sender':7A,54B,347C 'sensit':97C 'serv':305C 'server':69B,78C 'server-sid':77C 'side':79C 'silent':210C 'singl':196C 'sink':285C,366C 'site':281C 'size':244C,270C 'ssrf':82C 'start':136C,151C 'stream':395C,412C,425C 'string':4A,36B,126C 'subject':499C 'subprocess':300C 'suggest':399C,416C 'support':452C 'temporari':170C 'test':254C 'text':48B,57B,205C,225C,351C 'travers':93C 'treat':34B 'two':284C 'type':480C 'unauthor':101C 'unlik':341C 'upgrad':379C,401C,418C,458C 'upload':330C 'url':9A,41B,146C 'user':375C,388C,405C 'valu':241C,291C 'version':381C 'vulner':103C 'whatev':204C 'whenev':223C 'without':274C,367C 'wrap':250C 'written':167C 'x':393C,410C,423C 'zero':272C","nicknames":[],"mitigations":[],"who_affected":"Applications using Apache Camel's Docling component from 4.15.0 before 4.18.5, and from 4.19.0 before 4.22.1, where a route forwards a String body that an outside sender can influence into a Docling endpoint. Releases 4.14.x and earlier are end of life and receive no fix. Routes that pass typed bodies or use the file path header are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T11:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-78163","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78163","severity":null,"published_at":"2026-10-19T11:17:19+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}