docling-core CVE-2026-112310

Exploitation requires the target application to (a) load an attacker-supplied DoclingDocument (JSON or YAML) from an untrusted source, and (b) subsequently export it with ImageRefMode.EMBEDDED or render it to HTML - these export/render steps are what trigger the local file read. The specific bypass is that supplying a plain filesystem path (instead of a file:// URI) in the ImageRef evades the settings.allow_image_file_uri check, which in the vulnerable code only guarded the file:// scheme. Limiting factors: the leaked file must be parseable as an image by PIL and is subject to settings.max_image_decoded_size, so arbitrary non-image files are not disclosed wholesale (though path existence is still revealed via error behavior); exploitation depends on passive interaction by the processing pipeline (UI:P) rather than purely remote, unattended triggering; and impact is read-only disclosure with no write/execute capability.

This is a medium-severity information-disclosure issue, not a top-tier priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L) scores 5.3: network-reachable and unauthenticated (PR:N), but it hinges on passive user/application interaction (UI:P) - a victim service must actually export the attacker's DoclingDocument with ImageRefMode.EMBEDDED or render it to HTML before anything leaks. Impact is confined to confidentiality at LOW (VC:L, VI:N, VA:N): the attacker reads local image files and confirms path existence, with no integrity or availability effect and no code execution. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from the data; per the precision rules, no public exploit is identified at time of analysis. Note the signals are internally consistent (medium CVSS, no KEV, no POC) and point to a genuine but bounded risk that matters mainly for services that ingest untrusted DoclingDocument JSON/YAML; for closed pipelines processing only trusted documents the real-world risk is low. One caveat: the input 'Authentication Bypass' tag overstates the issue - CWE-73 and the diff show a bypass of the allow_image_file_uri security gate, not of any authentication mechanism.

An attacker crafts a DoclingDocument JSON or YAML in which an ImageRef uses a plain filesystem path (e.g. /etc/ssl/… or a sensitive image on the host) rather than a file:// URI, evading the allow_image_file_uri gate. When a service built on docling-core loads that untrusted document and exports it with ImageRefMode.EMBEDDED or renders it to HTML, the local file is read and embedded as base64 in the output, disclosing its contents and confirming the path exists. No public exploit is identified at time of analysis; the attack requires the processing application to perform the embedded export or HTML render (UI:P).