Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component.
This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2.
DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose flags the fix for CVE-2026-40047 restricted to an allowlist. That fix also introduced validatePathSafety to keep path-like argument values inside the intended directory, but the method only looked for relative traversal: it rejected a value containing a traversal sequence such as ../ and a value whose normalized form still held a .. element. It never checked whether a value was an absolute path, and an absolute path without traversal segments contains neither, so it passed unchanged. Every path-like value went through this check, whether it was a separate list element following its flag or was attached to the flag after an equals sign, so an absolute path was accepted in either form, for example as the directory given to the allowlisted --artifacts-path flag, which tells docling where to find its model artifacts. Such a value reached the docling command line as given, so a party able to choose the custom arguments could point the docling process at any directory the Camel process can access, outside the working directory that the check was meant to keep path values in, which is the outcome the CVE-2026-40047 fix set out to prevent. Only the CLI mode, which is the default, passes custom arguments to docling. The header belongs to the Camel header namespace, which consumers applying Camel's default header filtering, such as the JMS and Kafka consumers, remove from incoming messages, so the issue is reached where a route forwards externally influenced values into the header or where a consumer maps incoming headers without that filtering.
Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgrade immediately, do not build the CamelDoclingCustomArguments header from values that originate outside the deployment, remove that header from messages that arrive from outside before they reach a docling endpoint, and make sure that consumers which map incoming message headers drop the Camel header namespace, so that only the route itself chooses the custom arguments.
CVE-2026-95629 is a path traversal vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.2. The issue arises because the CamelDoclingOutputFilePath header value is passed verbatim to the external docling tool's --output flag without proper normalization or directory confinement, allowing an attacker able to set this header to write conversion output files to arbitrary writable directories. The vulnerability is fixed in Apache Camel versions 4.18.5 and 4.22.2 with the introduction of an outputBaseDirectory option to restrict output paths. Users are advised to upgrade to these fixed versions and configure the new option if the header can be influenced externally. For those unable to upgrade immediately, mitigating controls include sanitizing or removing the header from external inputs and ensuring header filtering is applied.
CVE-2026-95663 is an insufficient session expiration vulnerability in the Apache Camel Keycloak component affecting versions from 4.16.0 before 4.18.5 and from 4.19.0 before 4.22.2. When token introspection is enabled, the component caches token introspection results without respecting the token's expiration time, allowing expired tokens to be accepted for up to the cache's time-to-live. This can permit continued use of recently expired tokens for a short window, but does not allow token forgery or privilege escalation. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.2.
CVE-2026-95664 is an Expression Language Injection vulnerability in the Apache Camel AWS2-s3 component affecting versions from 4.8.0 before 4.18.5 and from 4.19.0 before 4.22.2. The issue arises because the key used by the aws2-s3 producer is taken from a message header and evaluated as a Simple language expression if it contains certain markers, allowing untrusted input to be executed. This can lead to unauthorized access to JVM system properties, environment variables, and invocation of methods on beans, potentially exposing sensitive information. The vulnerability is fixed in versions 4.18.5 and 4.22.2. Users are advised to upgrade to these versions or 4.23.0 or later. Workarounds include removing or validating the CamelAwsS3Key header to prevent untrusted expressions from being evaluated.
CVE-2026-101259 is a vulnerability in the Apache Camel CoAP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. It allows generation of error messages containing sensitive internal information such as class names, file paths, host names, and connection details. This occurs when the CoAP consumer fails to build its response after route completion and returns detailed exception messages in a 5.00 Internal Server Error response. The issue is fixed in Apache Camel versions 4.18.5, 4.22.2, and later 4.23.0. Users are advised to upgrade to these fixed versions to prevent sensitive information disclosure.
A heap-based buffer overflow vulnerability exists in the ole_info_read_metabat function of the OLE2 Parser component in GNOME libgsf up to version 1.14.60. This vulnerability can be triggered remotely and may lead to limited confidentiality, integrity, and availability impacts. A patch identified by commit a8e25560b74f84c3f86df6ca0ac59195fa5af68a is recommended to fix the issue.
Starman versions before 0.4019 for Perl contain a vulnerability that allows remote attackers to exhaust worker memory by sending chunked HTTP request bodies with unbounded chunk sizes. The chunked body decoder buffers each chunk in memory without limiting the length of the chunk-size line, enabling a single connection to cause memory exhaustion.
Starman versions before 0.4019 for Perl incorrectly send response bodies for HEAD requests, causing desynchronization of responses on keep-alive connections. This includes responses with status codes 1xx, 204, or 304, which also carry a body improperly. As a result, clients may misinterpret response data, and front-end proxies reusing upstream connections may associate responses with incorrect requests.
Starman versions before 0.4019 for Perl contain a vulnerability that allows remote attackers to cause CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. The issue arises because the regex used to match chunk-size lines does not handle certain line endings correctly, leading to excessive backtracking and CPU usage. This can be triggered by sending specially crafted requests to any route.
Starman versions before 0.4019 for Perl have a vulnerability where a stalled request body can indefinitely hold a worker thread, causing denial of service. This occurs because the read_timeout setting only applies to headers, while the body is read with blocking calls without a deadline. An attacker can exploit this by sending complete headers and then stalling or trickling the request body, tying up workers until they disconnect. Version 0.4019 introduces fixes by applying read_timeout to body reads and adding a body_timeout limit of 300 seconds.
Rclone versions before v1.75.2 contain a vulnerability in the b2 backend that can expose live account authorization tokens and SSE-C encryption keys via HTTP redirects. This occurs when redirects downgrade from HTTPS to HTTP or involve cross-host redirects, potentially leaking sensitive credentials in cleartext.
Rclone versions before 1.75.2 have a path traversal vulnerability in the local backend's translateLink function. This flaw occurs because the function trims the .rclonelink suffix after performing a containment check, allowing a crafted directory name to resolve outside the intended destination root. An attacker can exploit this by planting a directory named ...rclonelink in a source tree synced with --links and --metadata options, potentially changing ownership, timestamps, and extended attributes of the destination's parent directory.
Rclone versions from 1.52.0 up to but not including 1.75.2 contain a cross-site request forgery (CSRF) vulnerability in the pCloud backend's localhost OAuth callback. This flaw disables the state check and trusts the hostname parameter, allowing malicious web pages to send unauthorized requests to the local port during authorization. Attackers can plant tokens and API hosts, causing subsequent transfers to be redirected to attacker-controlled endpoints.
Rclone versions from 1.64.0 up to but not including 1.75.2 contain an authentication bypass vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to bypass authentication by sending OPTIONS requests. Exploitation enables attackers to probe arbitrary paths and use the Allow header values to determine the existence of files or collections, facilitating namespace enumeration.
rclone versions from 1.37 up to but not including 1.74.2 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to redirect HTTP and NetStorage backend requests by supplying a double-slash root on an existing named remote via the --rc-serve option. Exploitation enables attackers to make HEAD or GET requests to attacker-chosen hosts, potentially reading responses, capturing configured custom headers, or obtaining valid NetStorage request signatures.
Rclone versions before 1.75.2 have a path traversal vulnerability in the serve webdav feature. This flaw allows unauthenticated attackers to write files outside the intended served root directory by using unvalidated '..' path components. Attackers can exploit this by sending MKCOL /.. requests to create virtual file system nodes, then use PUT, MOVE, COPY, or MKCOL methods to create, overwrite, or delete files belonging to other tenants.
rclone versions from 1.56.0 up to but not including 1.75.2 have an information disclosure vulnerability in the WebDAV backend. This flaw causes custom credential headers configured by the operator to be forwarded to different hosts during HTTP 3xx redirects. An attacker who can control or influence such redirects may capture sensitive headers like X-Auth-Token and reuse them against the original WebDAV service. The vulnerability has a low severity rating with a CVSS score of 3.7.
rclone versions from 1.55.0 up to but not including 1.75.2 contain a vulnerability in the stable selfupdate mechanism. This flaw allows an attacker controlling the release distribution path to bypass signature verification by exploiting trust in checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. As a result, the selfupdate process can be tricked into installing a malicious rclone executable.
ImageMagick versions before 6.9.13-58 and 7.x before 7.1.2-33 contain a heap-based buffer overflow vulnerability in the X11 animate operation. This flaw allows an attacker to supply a crafted image that, when processed with the X11 animate operation, can overwrite heap memory and crash the application. The vulnerability has a low severity score and does not impact confidentiality or integrity but can cause denial of service through application crashes.