{"action":"Upgrade org.apache.camel:camel-docling to 4.18.3 or later.","affected":[{"fixed":"4.18.3","introduced":"4.15.0"}],"component":"org.apache.camel:camel-docling","cve_ids":["CVE-2026-40047"],"ecosystem":"Maven","exploited":false,"fixed_versions":["4.18.3"],"ghsa_id":"GHSA-rpv3-6645-2vqc","id":"tcs_01M5N9C8G7RN199JSF6PFDYPTM","modified_at":"2026-08-26T14:56:26.972839Z","published_at":"2026-07-06T09:30:28Z","references":["https://osv.dev/vulnerability/GHSA-rpv3-6645-2vqc","https://nvd.nist.gov/vuln/detail/CVE-2026-40047","https://github.com/apache/camel/pull/22082","https://github.com/apache/camel/pull/22767","https://github.com/apache/camel/commit/1fa56f45901f50aa79849ff2d2ca83dd57f6991c","https://github.com/apache/camel/commit/f86fda0442c65b9d13ce3aa8ac676233b64e3351","https://camel.apache.org/security/CVE-2026-40047.html","https://github.com/apache/camel","https://github.com/apache/camel/releases/tag/camel-4.18.3","https://github.com/apache/camel/releases/tag/camel-4.19.0","https://issues.apache.org/jira/browse/CAMEL-23212","http://www.openwall.com/lists/oss-security/2026/07/05/2"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-rpv3-6645-2vqc","url":"https://osv.dev/vulnerability/GHSA-rpv3-6645-2vqc"}],"summary":"Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer"}