https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 20:12:04 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-78163 <p>Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.</p> <p>This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.</p> <p>DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encod…</p> <p>Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.</p> <p>This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.</p> <p>DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encod…</p> https://db.gcve.eu/vuln/fkie_cve-2026-78163 https://db.gcve.eu/vuln/ghsa-62ww-q9gh-hmrv <p>Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.</p> <p>This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.</p> <p>DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encod…</p> <p>Server-Side Request Forgery (SSRF), Improper Limitation of a Pathname to a Restricted Directory (&#39;Path Traversal&#39;) and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Docling component.</p> <p>This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1.</p> <p>DoclingProducer decided what a String message body meant by inspecting its prefix. A body starting with http:// or https:// was handed to Docling as a remote URL to fetch, a body starting with / or containing a backslash was read from the local filesystem, and anything else was written to a temporary file and converted as document content. The mode was chosen implicitly and no endpoint option allowed a route author to pin the component to a single interpretation, so a route that means convert whatever text arrives in the body silently became a fetcher of remote resources or a reader of local files whenever the text happened to begin with one of those prefixes. The only guard applied to the derived value was a size check, and that check was wrapped in an existence test, so a path that resolved to nothing, or to a pseudo-file reporting a size of zero, passed without being checked at all. Five call sites reached the two sinks: the CLI mode appended the value as the final positional argument of the docling subprocess, and the docling-serve mode passed it either to HttpSource for the backend to fetch or to Files.readAllBytes so that the content could be base64-encod…</p> https://db.gcve.eu/vuln/ghsa-62ww-q9gh-hmrv