What is the CVSS score of CVE-2026-44017?

CVE-2026-44017 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Docling are affected by CVE-2026-44017?

IBM Docling versions before 2.91.0 contain a path traversal vulnerability enabling remote code execution if attackers intercept model downloads; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-44017?

24 hours: Identify all systems running Docling and document versions in use. 7 days: Contact IBM support for v2.91.0 patch timeline and implement network-level controls restricting model download sources to verified endpoints. 30 days: Deploy Docling v2.91.0 immediately upon release and verify package integrity through trusted channels.

Docling CVE-2026-44017

EUVD-2026-39006 HIGH

Path Traversal (CWE-22)

2026-06-03 https://github.com/docling-project/docling

GHSA-cjqg-rq2h-2fvj

Python Path Traversal RCE

7.5

CVSS 3.1 · Vendor: https://github.com/docling-project/docling

Severity by source

Vendor (https://github.com/docling-project/docling) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.3 HIGH

qualitative

Primary rating from Vendor (https://github.com/docling-project/docling).

CVSS VectorVendor: https://github.com/docling-project/docling

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 03, 2026 - 20:50 vuln.today

Analysis Generated

Jun 03, 2026 - 20:50 vuln.today

CVE Published

Jun 03, 2026 - 20:02 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on docling (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 2.91.0.

DescriptionCVE.org

Impact

In versions < 2.91.0, The EasyOCR model download functionality extracted ZIP archives without validating member paths, enabling Zip Slip attacks. If an attacker could compromise the model download source (via supply chain attack, DNS spoofing, or MITM), they could write arbitrary files to any location writable by the process, potentially achieving:

Remote code execution by overwriting Python files or system binaries
Persistent backdoors by modifying startup scripts or SSH keys
Data corruption or system compromise

Patches

Fixed in version 2.91.0. The extraction process now validates each archive member path using os.path.realpath() to ensure it remains within the target directory, raising a SecurityError for any path traversal attempts.

Workarounds

Ensure model downloads occur over secure, authenticated channels. Use integrity verification (checksums) for downloaded models. Run the application with minimal file system permissions.

References

Fix release: v2.91.0

AnalysisAI

Path traversal (Zip Slip) in IBM's Docling document processing library before v2.91.0 allows arbitrary file write when the EasyOCR model download function extracts ZIP archives without validating member paths. An attacker who can intercept or substitute the model download source (via MITM, DNS spoofing, or upstream supply-chain compromise) can drop files anywhere the process can write, leading to RCE or persistence. No public exploit identified at time of analysis and the vulnerability is not on the CISA KEV list.

Technical ContextAI

Docling is a Python library (distributed as the PyPI package docling, CPE pkg:pip/docling) used for converting documents into structured formats and integrating OCR through EasyOCR. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the EasyOCR model bootstrap routine: ZIP archives fetched from the network were passed through Python's zipfile extraction without sanitizing entry names, so archive members containing '../' sequences or absolute paths would be written outside the intended model cache directory. This is the classic Zip Slip pattern. The fix in commit 5e161ac (PR #3339, released as v2.91.0) wraps each member with os.path.realpath() and compares it against the resolved target directory, raising SecurityError on any traversal attempt.

RemediationAI

Vendor-released patch: upgrade docling to version 2.91.0 or later (pip install --upgrade docling>=2.91.0); the patched release notes are at https://github.com/docling-project/docling/releases/tag/v2.91.0 and the underlying fix is commit 5e161ac referenced by PR #3339. If immediate upgrade is not possible, the vendor's workarounds apply: ensure EasyOCR model downloads traverse only secure, authenticated channels (pin HTTPS, validate certificates, and avoid untrusted proxies that could MITM the connection), verify model archive integrity out-of-band with checksums before extraction, and run the Docling process as a least-privileged user so any successful traversal cannot overwrite system binaries, Python site-packages, or SSH authorized_keys. A more aggressive compensating control is to pre-stage model files into Docling's expected cache directory so the vulnerable download/extract path is never invoked at runtime - the side effect is losing automatic model updates and requiring manual refresh.