EUVD-2026-92814
GHSA-q43m-vhcp-mhvm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
An attacker remotely submits crafted HTML with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is read-only disclosure of local files (C:H, I:N, A:N) with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorNVD
Lifecycle Timeline
7Blast Radius
ecosystem impact- 1 pypi packages depend on docling (1 direct, 0 indirect)
- 2 pypi packages depend on docling-slim (1 direct, 1 indirect)
Ecosystem-wide dependent count for version 2.82.0 and other introduced versions.
DescriptionNVD
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.
AnalysisAI
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered page image. When an application explicitly sets HTMLBackendOptions(render_page=True), has the optional Playwright dependency installed, and passes untrusted HTML as a filesystem Path, the HTML backend's browser request filter fails to enforce the enable_local_fetch setting or confine file:// access to the source document's directory, so an <iframe src="file:///..."> can pull in .env files, credentials, or other users' documents that Chromium then renders visibly into the output image. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of: (1) the application explicitly sets HTMLBackendOptions(render_page=True) in Python (the default is render_page=False and is NOT vulnerable); (2) the optional Playwright dependency is installed so headless-browser rendering actually runs; and (3) untrusted HTML is supplied as a filesystem Path, because Path inputs are loaded via a file:// URL while stream inputs use an opaque origin that Chromium will not load file:// subresources from. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H) reflects worst-case confidentiality loss, but every other signal argues for a comparatively low real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Docling 2.118.1, the exact version containing the fix (https://github.com/docling-project/docling/releases/tag/v2.118.1), which corresponds to upstream fix commit 1612b8875b0937447ce3122536fb5360a7102a0a and PR #3948; the same 2.118.1 version resolves docling-slim. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Docling deployments and confirm whether HTMLBackendOptions(render_page=True) is enabled with the optional Playwright dependency and whether untrusted HTML is passed as a filesystem Path; if so, disable render_page or remove Playwright from untrusted-input processing paths and block file:// requests until patched. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Docling Slim
View allDocling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today