Vulnerability-Lookup

GHSA-P944-4XH2-X776

Vulnerability from github – Published: 2026-10-07 20:41 – Updated: 2026-10-07 20:41

Summary

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Details

Summary

docling accepts serialized DoclingDocument JSON as an input format (InputFormat.JSON_DOCLING, enabled by default). A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images (ImageRefMode.EMBEDDED, the CLI default for Markdown and HTML), the referenced file is read and embedded as base64 in the output.

Details

docling/backend/json/docling_json_backend.py validates the JSON into a DoclingDocument without checking image references. The file is then read by docling-core:

DoclingDocument._with_embedded_pictures opens file:// and plain-path URIs with PIL.
ImageRef.pil_image checks allow_image_file_uri for file:// URIs but not for plain Path values. docling's picture enrichment models load images through this property.

Only files that PIL can decode as an image are disclosed. Other files, such as text files or keys, fail to decode and are not embedded. The different error behaviour does reveal whether a path exists.

Impact

Disclosure of image files readable by the converting process (for example other users' uploads or page images in a shared service), and disclosure of whether a local path exists.

Proof of concept

from pathlib import Path
from docling_core.types.doc import DoclingDocument, ImageRef
from docling_core.types.doc.base import Size

doc = DoclingDocument(name="poc")
doc.add_picture(image=ImageRef(mimetype="image/png", dpi=72, size=Size(width=1, height=1),
                               uri=Path("/srv/uploads/other-user/scan.png")))
doc.save_as_json("poc.json")

docling poc.json --to md embeds the referenced PNG as base64 in poc.md.

Patches

Fixed in docling 2.131.0 by #4417. The Docling JSON backend now drops image references that point at local files (paths, file: URIs and any scheme other than data: and http(s)) and logs a warning. Callers that need to load local images from JSON they trust can opt in with DoclingJSONFormatOption(backend_options=DeclarativeBackendOptions(enable_local_fetch=True)); the CLI has no such option.

Code that loads untrusted JSON directly with docling-core (DoclingDocument.load_from_json) and exports it with embedded images is not covered by this fix; that part is tracked in docling-core.

Workarounds

Upgrade to 2.131.0. For older versions:

Remove InputFormat.JSON_DOCLING from allowed_formats when converting untrusted input.
Export with ImageRefMode.PLACEHOLDER or ImageRefMode.REFERENCED instead of EMBEDDED.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.16.0"
            },
            {
              "fixed": "2.131.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.92.0"
            },
            {
              "fixed": "2.131.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-105748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:41:08Z",
    "nvd_published_at": "2026-10-05T22:16:57Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\ndocling accepts serialized `DoclingDocument` JSON as an input format (`InputFormat.JSON_DOCLING`, enabled by default). A crafted JSON file can set a picture\u0027s image `uri` to a local file path. When the converted document is exported with embedded images (`ImageRefMode.EMBEDDED`, the CLI default for Markdown and HTML), the referenced file is read and embedded as base64 in the output.\n\n### Details\n\n`docling/backend/json/docling_json_backend.py` validates the JSON into a `DoclingDocument` without checking image references. The file is then read by docling-core:\n\n- `DoclingDocument._with_embedded_pictures` opens `file://` and plain-path URIs with PIL.\n- `ImageRef.pil_image` checks `allow_image_file_uri` for `file://` URIs but not for plain `Path` values. docling\u0027s picture enrichment models load images through this property.\n\nOnly files that PIL can decode as an image are disclosed. Other files, such as text files or keys, fail to decode and are not embedded. The different error behaviour does reveal whether a path exists.\n\n### Impact\n\nDisclosure of image files readable by the converting process (for example other users\u0027 uploads or page images in a shared service), and disclosure of whether a local path exists.\n\n### Proof of concept\n\n```python\nfrom pathlib import Path\nfrom docling_core.types.doc import DoclingDocument, ImageRef\nfrom docling_core.types.doc.base import Size\n\ndoc = DoclingDocument(name=\"poc\")\ndoc.add_picture(image=ImageRef(mimetype=\"image/png\", dpi=72, size=Size(width=1, height=1),\n                               uri=Path(\"/srv/uploads/other-user/scan.png\")))\ndoc.save_as_json(\"poc.json\")\n```\n\n`docling poc.json --to md` embeds the referenced PNG as base64 in `poc.md`.\n\n### Patches\n\nFixed in docling 2.131.0 by [#4417](https://github.com/docling-project/docling/pull/4417). The Docling JSON backend now drops image references that point at local files (paths, `file:` URIs and any scheme other than `data:` and `http(s)`) and logs a warning. Callers that need to load local images from JSON they trust can opt in with `DoclingJSONFormatOption(backend_options=DeclarativeBackendOptions(enable_local_fetch=True))`; the CLI has no such option.\n\nCode that loads untrusted JSON directly with docling-core (`DoclingDocument.load_from_json`) and exports it with embedded images is not covered by this fix; that part is tracked in docling-core.\n\n### Workarounds\n\nUpgrade to 2.131.0. For older versions:\n\n- Remove `InputFormat.JSON_DOCLING` from `allowed_formats` when converting untrusted input.\n- Export with `ImageRefMode.PLACEHOLDER` or `ImageRefMode.REFERENCED` instead of `EMBEDDED`.",
  "id": "GHSA-p944-4xh2-x776",
  "modified": "2026-10-07T20:41:08Z",
  "published": "2026-10-07T20:41:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105748"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/pull/4417"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.131.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Docling: Crafted DoclingDocument JSON embeds local image files into converted output"
}

CVE-2026-105748 (GCVE-0-2026-105748)

Vulnerability from cvelistv5 – Published: 2026-10-05 21:34 – Updated: 2026-10-06 14:17

Title

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

Summary

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 14:16 UTC

CWE

CWE-73 - External Control of File Name or Path
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/docling-project/docling/securi…	x_refsource_CONFIRM
https://github.com/docling-project/docling/pull/4417	x_refsource_MISC
https://github.com/docling-project/docling/commit…	x_refsource_MISC
https://github.com/docling-project/docling/releas…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
docling-project	docling	Affected: >= 2.16.0, < 2.131.0
docling-project	docling-slim	Affected: >= 2.16.0, < 2.131.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105748",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T14:16:57.407957Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T14:17:25.343Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docling",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.16.0, \u003c 2.131.0"
            }
          ]
        },
        {
          "product": "docling-slim",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.16.0, \u003c 2.131.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend in docling/backend/json/docling_json_backend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument._with_embedded_pictures and ImageRef.pil_image methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73: External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T21:34:25.628Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docling-project/docling/security/advisories/GHSA-p944-4xh2-x776"
        },
        {
          "name": "https://github.com/docling-project/docling/pull/4417",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/pull/4417"
        },
        {
          "name": "https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4"
        },
        {
          "name": "https://github.com/docling-project/docling/releases/tag/v2.131.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/releases/tag/v2.131.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p944-4xh2-x776",
        "discovery": "UNKNOWN"
      },
      "title": "Docling: Crafted DoclingDocument JSON embeds local image files into converted output"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105748",
    "datePublished": "2026-10-05T21:34:25.628Z",
    "dateReserved": "2026-10-05T19:11:07.947Z",
    "dateUpdated": "2026-10-06T14:17:25.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-P944-4XH2-X776

Summary

Details

Impact

Proof of concept

Patches

Workarounds

CVE-2026-105748 (GCVE-0-2026-105748)

Tags

Sightings

Nomenclature

Related by attack behaviour