HTML URI Path Handling Vulnerability in Docling

Executive Summary

The CVE-2026-47214 vulnerability affects the Docling library versions prior to 2.94.0, specifically in its HTML backend. The issue involves unsafe handling of URIs and file paths, which can lead to security risks such as unauthorized access to local files, path traversal attacks, and unintended access to network resources.

This vulnerability occurs when the options `enable_local_fetch` or `enable_remote_fetch` are enabled, as the backend does not properly validate the resources it processes. Attackers can exploit this by using `file://` URIs to access local files, path traversal sequences like `../` to escape intended directories, or by accessing internal network resources.

Additionally, the lack of validation for HTTP redirects and resource limits can lead to uncontrolled resource consumption, such as excessive downloads or processing of data URIs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsafe handling of URIs and file paths in the Docling HTML backend when the options `enable_local_fetch` or `enable_remote_fetch` are enabled. Detection can focus on identifying whether these options are enabled and monitoring for suspicious URI patterns such as `file://` URIs or path traversal sequences like `../` in processed documents.

You can check your Docling configuration or code to see if `enable_local_fetch` or `enable_remote_fetch` are set to true. Additionally, monitoring logs or network traffic for unusual access to local files or internal network resources triggered by these options may help detect exploitation attempts.

Specific commands depend on your environment, but examples include:

• Review configuration files or code for `enable_local_fetch` and `enable_remote_fetch` settings.
• Use network monitoring tools (e.g., tcpdump, Wireshark) to detect unexpected outbound requests or file access patterns.
• Search logs for URI patterns like `file://` or path traversal sequences (`../`). For example, using grep: `grep -r "file://" /path/to/logs` or `grep -r "\.\./" /path/to/logs`.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts including unauthorized access to sensitive local files and internal network resources, which compromises confidentiality.

It can also lead to resource exhaustion due to uncontrolled downloads or processing, potentially causing denial of service or degraded performance.

The vulnerability does not require user interaction to be exploited, increasing the risk of automated or remote attacks.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Docling prior to version 2.94.0 involves unsafe URI and path handling that can lead to unauthorized access to local files and internal network resources. This unauthorized data access poses a confidentiality risk, which could impact compliance with data protection regulations such as GDPR and HIPAA that require safeguarding sensitive and personal data.

Specifically, the potential for attackers to access confidential information without user interaction could violate requirements for data confidentiality and integrity under these standards. Therefore, if exploited, this vulnerability could lead to non-compliance with regulations that mandate strict controls over access to sensitive data.

Mitigation involves disabling the `enable_local_fetch` and `enable_remote_fetch` options by default when processing untrusted HTML documents, reducing the risk of unauthorized data exposure and helping maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation is to ensure that both `enable_local_fetch` and `enable_remote_fetch` options are disabled when processing untrusted HTML documents.

Additionally, upgrading Docling to version 2.94.0 or later, where this vulnerability is fixed, is strongly recommended.

By disabling these options and applying the update, you prevent exploitation paths such as local file access, path traversal, and unintended network resource access.

Useful 0 Not Useful 0