CVE-2026-112310
Received Received - Intake

Local File Disclosure in Docling-Core via ImageRef URIs

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112310
EUVD
EUVD-2026-104402

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
docling-project docling-core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in docling-core through 2.102.0 allows attackers to read local images by providing plain filesystem paths in ImageRef URIs. It bypasses the allow_image_file_uri gate, enabling attackers to submit crafted DoclingDocument JSON or YAML that embeds local image files as base64 when exported or rendered to HTML, revealing file paths.

Detection Guidance

Check for Docling-core versions prior to 2.102.1. Inspect JSON/YAML files using ImageRef URIs for plain filesystem paths. Monitor logs for unexpected image embeddings or base64 data in exports.

Impact Analysis

Attackers could exploit this to access sensitive local image files on your system, potentially exposing confidential or private data. This could lead to unauthorized information disclosure if local images contain sensitive content.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if it results in unauthorized access to personal or health-related images. Organizations may face legal penalties or reputational damage due to data breaches.

Mitigation Strategies

Upgrade docling-core to version 2.102.1 or later. Disable allow_image_file_uri if not required. Validate all ImageRef URIs to ensure they do not reference local filesystem paths.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart