CVE-2026-105748— Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Quick assessment
Affected
docling-project docling
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Docling 通过解析多种文档格式并提供与生成式 AI 生态系统的集成，简化了文档处理流程。在版本 2.16.0 至 2.131.0 之间，Docling 的 后端（位于 ）在验证序列化的 DoclingDocument 输入时，未拒绝包含本地路径或文件 URI 的图片引用。当文档通过 模式进行增强或导出时， 和 方法会打开这些引用，并将可读的图像字节嵌入到 Markdown 或 HTML 输出中。披露范围限于 Pillow 能够解码为图像的格式，但由于不同解码行为可能揭示路径是否存在，这也可能导致信息泄露。通过
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1005 · Data from Local System
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105748
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Source: CVE Program / CVE List V5
Vulnerability Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| docling-project | docling | >= 2.16.0, < 2.131.0 | - |
|
| docling-project | docling-slim | >= 2.16.0, < 2.131.0 | - |
|
II. Public POCs for CVE-2026-105748
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105748
请登录查看更多情报信息。
Other References for CVE-2026-105748 (4)
-
https://github.com/docling-project/docling/pull/4417 x_refsource_MISC
-
https://github.com/docling-project/docling/releases/tag/v2.131.0 x_refsource_MISC
Same Patch Batch · docling-project · 2026-10-05 · 10 CVEs total
| CVE-2026-105744 | 7.5 HIGH | Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) wh |
| CVE-2026-105751 | 6.9 MEDIUM | Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend |
| CVE-2026-105745 | 6.7 MEDIUM | Docling: Plugin entry points are imported before the allow_external_plugins check |
| CVE-2026-105749 | 6.5 MEDIUM | Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CP |
| CVE-2026-105750 | 5.9 MEDIUM | Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode |
| CVE-2026-105747 | 4.3 MEDIUM | Docling: METS-GBS archive member limit enforced after full member enumeration (memory exha |
| CVE-2026-105743 | 4.0 MEDIUM | Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resol |
| CVE-2026-105742 | 3.7 LOW | Docling: Configured HTTP headers sent to every remote image host named by a document |
| CVE-2026-105746 | 2.2 LOW | Docling: KServe v2 OCR engine does not enforce enable_remote_services |
IV. Related Vulnerabilities
Same product: docling
-
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href -
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browse -
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS -
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full m -
CVE-2026-105746
Docling: KServe v2 OCR engine does not enforce enable_remote
Same vendor: docling-project
-
CVE-2026-105751
Docling: Arbitrary local file read via draw:image xlink:href -
CVE-2026-105750
Docling: `enable_local_fetch` is not enforced in HTML browse -
CVE-2026-105749
Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS -
CVE-2026-105747
Docling: METS-GBS archive member limit enforced after full m -
CVE-2026-105746
Docling: KServe v2 OCR engine does not enforce enable_remote
Same weakness: CWE-73
-
CVE-2026-103511
Arbitrary file-write via extension installation in P4Search -
CVE-2026-104809
Mitel MiVoice Office 400 Shared Object Hijacking Leading to -
CVE-2026-103507
Arbitrary file-write via log configuration path in P4Search -
CVE-2026-71453
Johnson Controls EasyIO FS32 (<3.0b63) 路径遍历漏洞 -
CVE-2026-103255
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Q
V. Comments for CVE-2026-105748
No comments yet