CVE-2026-105744

Received Received - Intake

LatexBackendOptions TikZ Engine File Read and Write in Docling

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected. This vulnerability is fixed in 2.132.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105744

Affected Vendors & Products

Vendor	Product	Version / Range
docling-project	docling	>= 2.94.0, < 2.132.0
docling-project	docling-slim	>= 2.94.0, < 2.132.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

Docling is a document processing tool that parses various formats and integrates with AI systems. Between versions 2.94.0 and 2.132.0, a vulnerability exists when users enable LatexBackendOptions with tikz_engine set to tectonic. This allows untrusted TikZ input to compile without restrictions on TeX primitives like openin and openout. Attackers can exploit this to read files accessible to the converter or create and overwrite writable files. If tikz_engine_allow_shell_escape is enabled, shell commands can also be executed.

Detection Guidance

Check if your Docling version is between 2.94.0 and 2.132.0 by running: pip show docling. If installed, verify if LatexBackendOptions(tikz_engine='tectonic') is used in your code. Inspect logs for file read/write operations or shell command executions during document processing.

Impact Analysis

If you use Docling versions 2.94.0 to 2.132.0 with LatexBackendOptions(tikz_engine='tectonic'), an attacker could read sensitive files on your system, modify or delete important files, or run unauthorized commands if shell escape is enabled. This could lead to data theft, system compromise, or service disruption.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using affected Docling versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Docling to version 2.132.0 or later immediately. If using LatexBackendOptions(tikz_engine='tectonic'), disable it or restrict TeX file primitives. Disable tikz_engine_allow_shell_escape if enabled. Review file permissions to limit write access.

Hi! I’m here to help you understand CVE-2026-105744. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70