This is an automated email from the ASF dual-hosted git repository. oscerd pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/camel-website.git
commit 7d367da1b8c5c3c5182219049f19c9ef5d8564a6 Author: Andrea Cosentino <[email protected]> AuthorDate: Mon Oct 19 10:36:37 2026 +0200 Added CVE-2026-95628 Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> --- content/security/CVE-2026-95628.md | 25 +++++++++++++++++++++ content/security/CVE-2026-95628.txt.asc | 39 +++++++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) diff --git a/content/security/CVE-2026-95628.md b/content/security/CVE-2026-95628.md new file mode 100644 index 00000000..3add39c3 --- /dev/null +++ b/content/security/CVE-2026-95628.md @@ -0,0 +1,25 @@ +--- +title: "Apache Camel Security Advisory - CVE-2026-95628" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-95628.html +draft: false +type: security-advisory +cve: CVE-2026-95628 +severity: MEDIUM +summary: "Camel-Docling: Custom CLI argument path validation does not reject absolute paths (incomplete fix of CVE-2026-40047)" +description: "DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose flags the fix for CVE-2026-40047 restricted to an allowlist. That fix also introduced validatePathSafety to keep path-like argument values inside the intended directory, but the method only looked for relative traversal: it rejected a value containing a traversal sequence such as ../ and a val [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgr [...] +credit: "This issue was discovered by Zhixi \"Jace\" Sun, independent security researcher" +affected: "From 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +--- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24893 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26738 (commit fd3bc8e73613f3aec691044ed07869ef79c1bf2f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26743 (commit e9233c37c6127221157ac0901fb74250c5d24e98) and to camel-4.18.x in https://github.com/apache/camel/pull/26744 (commit 59d30af17064320073e17cfb516be60d096bb979). + +The validatePathSafety helper now also rejects a path-like custom-argument value that is an absolute path, failing the exchange with an IllegalArgumentException stating that the argument must not be an absolute path. Because the check sits in the shared helper that validates every path-like value, whether it is a separate list element following its flag or is attached to the flag after an equals sign, it covers every path-valued flag on the allowlist rather than only the one that locates [...] + +Custom-argument values have never been checked for absolute paths. From its introduction in 4.15.0, camel-docling appended them to the docling command without any validation; a check added in 4.18.1 then refused the output flags and a literal ../ sequence, and the CVE-2026-40047 fix, released in 4.18.3 and 4.19.0, replaced that check with the allowlist and validatePathSafety. None of these versions rejected an absolute path, so the affected range starts at 4.15.0 rather than at the relea [...] + +This advisory is an incomplete-fix follow-on to CVE-2026-40047 (CAMEL-23212), whose fix introduced validatePathSafety to keep path-like custom-argument values from leaving the intended directory but only checked for relative traversal, so deployments that upgraded to 4.18.3 or 4.19.0 in response to that advisory remained exposed to absolute values. The CamelDoclingOutputFilePath header, which the custom-argument validation names as the way to choose the output directory, is not a custom [...] diff --git a/content/security/CVE-2026-95628.txt.asc b/content/security/CVE-2026-95628.txt.asc new file mode 100644 index 00000000..854f473b --- /dev/null +++ b/content/security/CVE-2026-95628.txt.asc @@ -0,0 +1,39 @@ +-----BEGIN PGP SIGNED MESSAGE----- +Hash: SHA512 + +- --- +title: "Apache Camel Security Advisory - CVE-2026-95628" +date: 2026-10-19T10:00:00+02:00 +url: /security/CVE-2026-95628.html +draft: false +type: security-advisory +cve: CVE-2026-95628 +severity: MEDIUM +summary: "Camel-Docling: Custom CLI argument path validation does not reject absolute paths (incomplete fix of CVE-2026-40047)" +description: "DoclingProducer builds the command line of the external docling tool and appends to it the custom arguments supplied in the CamelDoclingCustomArguments header, a list of strings whose flags the fix for CVE-2026-40047 restricted to an allowlist. That fix also introduced validatePathSafety to keep path-like argument values inside the intended directory, but the method only looked for relative traversal: it rejected a value containing a traversal sequence such as ../ and a val [...] +mitigation: "Users are recommended to upgrade to version 4.23.0, which fixes the issue. If users are on the 4.22.x releases stream, then they are suggested to upgrade to 4.22.2. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.5. The 4.15.x to 4.17.x and 4.19.x to 4.21.x release lines reached end of life before this issue was resolved and will not receive a fix, so deployments on them must move to a supported release. For deployments that cannot upgr [...] +credit: "This issue was discovered by Zhixi \"Jace\" Sun, independent security researcher" +affected: "From 4.15.0 before 4.18.5, from 4.19.0 before 4.22.2." +fixed: 4.18.5, 4.22.2 and 4.23.0 +- --- + +The JIRA ticket: https://issues.apache.org/jira/browse/CAMEL-24893 refers to the commits that resolved the issue, and has more details. + +The fix was merged on main in https://github.com/apache/camel/pull/26738 (commit fd3bc8e73613f3aec691044ed07869ef79c1bf2f), and backported to camel-4.22.x in https://github.com/apache/camel/pull/26743 (commit e9233c37c6127221157ac0901fb74250c5d24e98) and to camel-4.18.x in https://github.com/apache/camel/pull/26744 (commit 59d30af17064320073e17cfb516be60d096bb979). + +The validatePathSafety helper now also rejects a path-like custom-argument value that is an absolute path, failing the exchange with an IllegalArgumentException stating that the argument must not be an absolute path. Because the check sits in the shared helper that validates every path-like value, whether it is a separate list element following its flag or is attached to the flag after an equals sign, it covers every path-valued flag on the allowlist rather than only the one that locates [...] + +Custom-argument values have never been checked for absolute paths. From its introduction in 4.15.0, camel-docling appended them to the docling command without any validation; a check added in 4.18.1 then refused the output flags and a literal ../ sequence, and the CVE-2026-40047 fix, released in 4.18.3 and 4.19.0, replaced that check with the allowlist and validatePathSafety. None of these versions rejected an absolute path, so the affected range starts at 4.15.0 rather than at the relea [...] + +This advisory is an incomplete-fix follow-on to CVE-2026-40047 (CAMEL-23212), whose fix introduced validatePathSafety to keep path-like custom-argument values from leaving the intended directory but only checked for relative traversal, so deployments that upgraded to 4.18.3 or 4.19.0 in response to that advisory remained exposed to absolute values. The CamelDoclingOutputFilePath header, which the custom-argument validation names as the way to choose the output directory, is not a custom [...] +-----BEGIN PGP SIGNATURE----- + +iQEzBAEBCgAdFiEEJ2Y0ButtuvUpHyYV406fOAL/QQAFAmrV1j4ACgkQ406fOAL/ +QQD2nQf+NaHu7r9UZG57bytiGoSbJg0xzHFZ5Ri9Bdb2B+PNY5etU0wCroEOKb8p +1tunDFsLpGaqWM20KlvxWSHZczX+kVUy0pl72Haol07etoSZNZ+R8eWn6sJdYYeH +932PdGomlk86Re7dDykErAUVSCOcGrDhC16c8CLmmxi1Zx9O4rxZr9MnMSys3INb +XSULGx9Ahg/HQss2fiXvbWNy6xKbvu34aS1lU5b4/nm4pxYv8EwFJuS9uiOWYTUF +WPbMC8jOr2Ud7SJOnTAoc75tzKrkecJHm1v8u0j5EiFh0KxkEhy+3RNiAZgZjdNO +BjxrM5XNZo3pJxcR7uUBvNEx+H8FRA== +=BNY0 +-----END PGP SIGNATURE-----
