CVE-2026-105748

Received Received - Intake

Path Traversal in Docling Document Processing

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-05

Generated

2026-10-06

AI Q&A

2026-10-06

EPSS Evaluated

N/A

NVD

CVE-2026-105748

Affected Vendors & Products

Vendor	Product	Version / Range
docling-project	docling	>= 2.16.0, < 2.131.0
docling-project	docling-slim	>= 2.16.0, < 2.131.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The vulnerability in Docling (versions 2.16.0 to 2.131.0) involves improper validation of serialized DoclingDocument input. Specifically, the InputFormat.JSON_DOCLING backend fails to reject picture image references containing local paths or file URIs. When documents are enriched or exported with embedded images, these references can be opened, exposing readable image bytes in output formats like Markdown or HTML. The issue is limited to files Pillow can decode as images and may reveal path existence through decode behavior differences.

Detection Guidance

This vulnerability involves improper handling of local file paths or URIs in JSON input processed by Docling versions 2.16.0 to 2.131.0. To detect it, inspect Docling-generated outputs (Markdown or HTML) for embedded image references that may expose local file paths. Check if ImageRefMode.EMBEDDED is used during enrichment or export. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to access local files on your system if they can provide a specially crafted document. The attacker could embed local file paths in image references, which might then be read and included in exported outputs. This could lead to unauthorized information disclosure, such as viewing sensitive files or confirming the existence of specific paths.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. If local files containing such data are exposed through this vulnerability, it could result in data breaches, violating these regulations and potentially leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade Docling to version 2.131.0 or later to address the vulnerability in the InputFormat.JSON_DOCLING backend.

Hi! I’m here to help you understand CVE-2026-105748. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70