Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105751— Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Quick assessment

Affected
docling-project docling
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Docling 通过解析多种文档格式并提供与生成式 AI 生态系统的集成，简化了文档处理流程。在版本 2.107.0 至 2.120.3 之间， 在文档归档中未找到所引用的部分时，会直接使用 元素的 属性值作为文件系统路径。 函数在未进行协议（scheme）校验、未限制提取目录、且未采用其他后端所使用的 设置的情况下，读取了该由攻击者控制的路径。Pillow 能够解码为图像的只读文件会被嵌入到转换输出中，而其他已有路径也可通过尝试读取操作被区分出来。此问题已在版本 2.120.3 中得到修复。

CVSS 6.9 · Medium

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105751

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Source: CVE Program / CVE List V5
Vulnerability Description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
docling-project docling >= 2.107.0, < 2.120.3 -

II. Public POCs for CVE-2026-105751

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105751

请登录查看更多情报信息。

Other References for CVE-2026-105751 (4)

Same Patch Batch · docling-project · 2026-10-05 · 10 CVEs total

CVE-2026-105744 7.5 HIGH Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) wh
CVE-2026-105745 6.7 MEDIUM Docling: Plugin entry points are imported before the allow_external_plugins check
CVE-2026-105749 6.5 MEDIUM Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CP
CVE-2026-105750 5.9 MEDIUM Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode
CVE-2026-105748 4.3 MEDIUM Docling: Crafted DoclingDocument JSON embeds local image files into converted output
CVE-2026-105747 4.3 MEDIUM Docling: METS-GBS archive member limit enforced after full member enumeration (memory exha
CVE-2026-105743 4.0 MEDIUM Docling: SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resol
CVE-2026-105742 3.7 LOW Docling: Configured HTTP headers sent to every remote image host named by a document
CVE-2026-105746 2.2 LOW Docling: KServe v2 OCR engine does not enforce enable_remote_services

IV. Related Vulnerabilities

Same product: docling
Same vendor: docling-project
Same weakness: CWE-22

V. Comments for CVE-2026-105751

No comments yet

Leave a comment