MAVEN · JULY 2026 · EARLY WARNING

Apache Camel Docling Component Vulnerability: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: camel-docling (maven)
Patched version: 4.18.3

GHSA-RPV3-6645-2VQC

An early warning has been issued for a critical vulnerability in the Apache Camel Docling component. This vulnerability, tracked as GHSA-RPV3-6645-2VQC, allows for argument injection and path traversal due to insufficient validation of custom CLI arguments.

What happened

The Apache Camel Docling component is reportedly affected by a critical vulnerability that allows for argument injection and path traversal. This is due to improper neutralization of argument delimiters in versions before 4.18.3. The vulnerability has been assigned the identifier CVE-2026-40047 and is currently under investigation.

To assess your exposure, check if your system uses the camel-docling (maven) component in versions before 4.18.3. If so, you are potentially vulnerable to this issue. It is recommended to upgrade to version 4.18.3 or later to mitigate the risk.

What to do about it

Upgrade your Apache Camel Docling component to version 4.18.3 or later.
Review your system for any instances of the camel-docling (maven) component in versions before 4.18.3 and update them.
Monitor the primary sources for updates on this vulnerability.
Consider implementing additional security measures to protect against argument injection and path traversal attacks.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If camel-docling is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are potentially affected if your system uses the camel-docling (maven) component in versions before 4.18.3.

What should I do right now?

Upgrade your Apache Camel Docling component to version 4.18.3 or later.

Has this vulnerability been exploited in the wild?

There is no confirmed report of this vulnerability being exploited in the wild at this time.

Where can I find more information about this vulnerability?

Consult the primary sources provided for more detailed information.

Sources

[GHSA-rpv3-6645-2vqc] Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Join the 0Day waitlist →

← Back to all threats