Apache Camel Docling CVE-2026-78163

Exploitation requires that a Camel route forwards a String message body - originating outside the deployment - into the Apache Camel Docling component's producer, and that the affected versions are in use (4.15.0 to before 4.18.5, or 4.19.0 to before 4.22.1). The triggering condition is the body's leading content: a body starting with 'http://' or 'https://' is fetched as a remote URL (SSRF), while one starting with '/' or containing a backslash is read from the local filesystem (path traversal / file disclosure). Because the exchange body bypasses HeaderFilterStrategy filtering and no endpoint option existed to pin the interpretation mode, no deployment opt-in is needed once such a route exists. Limiting factors: the attacker must be able to influence a String body that reaches a docling endpoint, bodies passed as File, byte[], InputStream, or via the CamelDoclingInputFilePath header are not subject to prefix interpretation, and the Docling component is an optional, infrequently-deployed component - which, together with the implicit routing requirement, is why CVSS rates AC:H.

This is a moderate, conditions-dependent risk rather than a drop-everything priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N, base 5.9) captures the shape well: network-reachable and unauthenticated, but with High attack complexity because exploitation depends on a deployment-specific precondition - a Camel route that forwards attacker-influenced String bodies into a docling endpoint. The impact is confidentiality-only (C:H, I:N, A:N): SSRF to internal resources and local file disclosure via path traversal, with no integrity or availability effect. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - a genuine but complexity-gated flaw - rather than conflicting. The main caveat is exposure scope: the vulnerable code is the comparatively new, optional Camel Docling component, so most Camel deployments are not affected at all, and even affected ones are only reachable where untrusted text bodies flow into a docling endpoint. Prioritize patching where the docling component is in use and ingests externally-originated String bodies; elsewhere this is low real-world risk despite the network vector.

An application exposes a Camel route that accepts text from an external source (e.g. an HTTP intake, queue, or form field) and forwards it as the message body into a docling endpoint intending to convert it as document content. An attacker submits a body beginning with 'http://169.254.169.254/...' or a leading '/' (e.g. '/etc/passwd'), causing DoclingProducer to silently reinterpret the body as a URL to fetch (SSRF) or a local file to read and return. No public exploit is identified at time of analysis, but exploitation requires no authentication where such a route exists.