EUVD-2026-92815
GHSA-4xhp-xg4w-8ppm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated (PR:N) but needs a victim to convert the crafted ODF (UI:R); reads files outside the archive confinement boundary (S:C) disclosing contents (C:H) with no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 1 pypi packages depend on docling (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 2.107.0.
DescriptionCVE.org
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.
AnalysisAI
Local file disclosure in Docling's OpenDocument backend (versions 2.107.0 through 2.120.3) allows an attacker-supplied ODF file to force the parser to read arbitrary filesystem paths. When a draw:image element's xlink:href references a part missing from the document archive, the vulnerable backend treats the href as a local filesystem path without a scheme check or extraction-directory confinement, then embeds Pillow-decodable files into the converted output; non-image paths still leak existence information through read success or failure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a victim (or an automated pipeline) convert an attacker-supplied OpenDocument file through Docling's opendocument_backend, and specifically that the crafted document contain a draw:image whose xlink:href part is NOT present in the document archive - this is the exact trigger that causes the backend to treat the href as a filesystem path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a confidentiality-only path traversal / arbitrary local file read (CWE-22) with conflicting real-world weight. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Docling to version 2.120.3 or later, which is the vendor-released patch (commit 6ee9965adfc364b3696a67c825ec2f0d9cee4311, PR 4015) and routes external image references through ImageResourceLoader under the enable_local_fetch and enable_remote_fetch controls - see the advisory at https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm and the release at https://github.com/docling-project/docling/releases/tag/v2.120.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Local file disclosure in Docling allows crafted HTML to embed readable files from the host filesystem into the rendered
Docling 2.94.0 through 2.131.x allows an attacker-supplied LaTeX/TikZ document to read files accessible to the converter
Import-time code execution in Docling 2.27.0 through 2.131.0 lets any distribution already present in the same Python en
Unbounded rowspan/colspan attribute handling in Docling 2.0.0 through 2.130.x lets a deliberately crafted document force
Server-side request forgery in Docling 2.91.0 through 2.131.x lets an attacker-supplied document reach internal services
Docling 2.83.0 through 2.130.x ignores the enable_remote_services=False policy when OCR is configured with KserveV2OcrOp
Docling's HTML backend forwards operator-configured HTTP headers - bearer tokens, API keys, cookies set via HTMLBackendO
Processing a crafted document with Docling (or the docling-slim distribution) versions 2.45.0 through 2.130.x can exhaus
Information disclosure in Docling (and the docling-slim distribution) versions 2.16.0 through 2.130.x lets an attacker e
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today