https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:03:43 +0000 https://vulnerability.circl.lu/sighting/438b6142-7036-48bc-b5cc-6170523a91e3/export {"uuid": "438b6142-7036-48bc-b5cc-6170523a91e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105748", "type": "seen", "source": "https://gist.github.com/alon710/4025b456d711dbf884cc359650ea9b0d", "content": "# CVE-2026-105748: CVE-2026-105748: Local File Inclusion and Arbitrary File Disclosure in Docling Document Parser\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105748\n\n## Summary\nA Local File Inclusion (LFI) and Arbitrary File Disclosure vulnerability exists in Docling and Docling Slim versions >= 2.16.0 up to 2.131.0. When parsing serialized DoclingDocument structures using the JSON input format, the backend fails to restrict image URI schemes, allowing remote attackers to retrieve local files and verify path existence on the host system during embedded document export.\n\n## TL;DR\nDocling is vulnerable to Local File Inclusion via crafted JSON inputs, allowing attackers to read local system images or verify file existence.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-73 (External Control of File Name or Path)\n- **Attack Vector**: Network\n- **CVSS Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00218\n- **Impact**: Low Confidentiality (Local File Inclusion / Path Probing)\n- **Exploit Status**: PoC / Non-weaponized\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- docling-project/docling\n- docling-project/docling-slim\n- **docling**: >= 2.16.0, < 2.131.0 (Fixed in: `2.131.0`)\n- **docling-slim**: >= 2.16.0, < 2.131.0 (Fixed in: `2.131.0`)\n\n## Mitigation\n\n- Upgrade docling to version 2.131.0 or higher.\n- Ensure docling-core is upgraded to version 2.98.0 or higher.\n- Avoid processing untrusted JSON documents if immediate patching is not possible.\n- Implement strict schema validation at the application boundaries before passing documents to docling-core.\n\n**Remediation Steps:**\n1. Modify your dependency configuration (e.g. pyproject.toml or requirements.txt) to require docling>=2.131.0.\n2. Deploy the updated container or environment to production.\n3. Ensure that enable_local_fetch is disabled (default behavior) in all backend option configurations.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776)\n- [Official Fix Commit](https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4)\n- [Official Pull Request](https://github.com/docling-project/docling/pull/4417)\n- [Release Notes (v2.131.0)](https://github.com/docling-project/docling/releases/tag/v2.131.0)\n- [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-105748)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105748) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T08:30:28.000000Z"} {"uuid": "438b6142-7036-48bc-b5cc-6170523a91e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105748", "type": "seen", "source": "https://gist.github.com/alon710/4025b456d711dbf884cc359650ea9b0d", "content": "# CVE-2026-105748: CVE-2026-105748: Local File Inclusion and Arbitrary File Disclosure in Docling Document Parser\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-105748\n\n## Summary\nA Local File Inclusion (LFI) and Arbitrary File Disclosure vulnerability exists in Docling and Docling Slim versions >= 2.16.0 up to 2.131.0. When parsing serialized DoclingDocument structures using the JSON input format, the backend fails to restrict image URI schemes, allowing remote attackers to retrieve local files and verify path existence on the host system during embedded document export.\n\n## TL;DR\nDocling is vulnerable to Local File Inclusion via crafted JSON inputs, allowing attackers to read local system images or verify file existence.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-73 (External Control of File Name or Path)\n- **Attack Vector**: Network\n- **CVSS Score**: 4.3 (Medium)\n- **EPSS Score**: 0.00218\n- **Impact**: Low Confidentiality (Local File Inclusion / Path Probing)\n- **Exploit Status**: PoC / Non-weaponized\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- docling-project/docling\n- docling-project/docling-slim\n- **docling**: >= 2.16.0, < 2.131.0 (Fixed in: `2.131.0`)\n- **docling-slim**: >= 2.16.0, < 2.131.0 (Fixed in: `2.131.0`)\n\n## Mitigation\n\n- Upgrade docling to version 2.131.0 or higher.\n- Ensure docling-core is upgraded to version 2.98.0 or higher.\n- Avoid processing untrusted JSON documents if immediate patching is not possible.\n- Implement strict schema validation at the application boundaries before passing documents to docling-core.\n\n**Remediation Steps:**\n1. Modify your dependency configuration (e.g. pyproject.toml or requirements.txt) to require docling>=2.131.0.\n2. Deploy the updated container or environment to production.\n3. Ensure that enable_local_fetch is disabled (default behavior) in all backend option configurations.\n\n## References\n\n- [GitHub Security Advisory](https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776)\n- [Official Fix Commit](https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4)\n- [Official Pull Request](https://github.com/docling-project/docling/pull/4417)\n- [Release Notes (v2.131.0)](https://github.com/docling-project/docling/releases/tag/v2.131.0)\n- [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-105748)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-105748) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T08:30:28.000000Z"} https://vulnerability.circl.lu/sighting/438b6142-7036-48bc-b5cc-6170523a91e3/export Thu, 08 Oct 2026 08:30:28 +0000 https://vulnerability.circl.lu/sighting/5c93e250-e15a-4b5b-9027-f4bcf7cb018c/export {"uuid": "5c93e250-e15a-4b5b-9027-f4bcf7cb018c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105748", "type": "published-proof-of-concept", "source": "https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776", "content": "", "creation_timestamp": "2026-09-29T09:30:45.000000Z"} {"uuid": "5c93e250-e15a-4b5b-9027-f4bcf7cb018c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-105748", "type": "published-proof-of-concept", "source": "https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776", "content": "", "creation_timestamp": "2026-09-29T09:30:45.000000Z"} https://vulnerability.circl.lu/sighting/5c93e250-e15a-4b5b-9027-f4bcf7cb018c/export Tue, 29 Sep 2026 09:30:45 +0000