{"cve":"CVE-2026-105751","nvd":{"published":"2026-10-05T22:16:58.253","modified":"2026-10-16T20:45:30.910","status":"Analyzed","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-22"],"references":["https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311","https://github.com/docling-project/docling/pull/4015","https://github.com/docling-project/docling/releases/tag/v2.120.3","https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm","https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"],"products":["docling:docling"],"source":"nvd","synced_at":"2026-10-19T22:57:46.668721662+00:00"},"epss":{"cve":"CVE-2026-105751","score":0.00418,"percentile":0.35807,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-4xhp-xg4w-8ppm","url":"https://osv.dev/vulnerability/GHSA-4xhp-xg4w-8ppm","summary":"Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend","modified":"2026-10-15T14:56:09.853280668Z","packages":[{"ecosystem":"PyPI","name":"docling","purl":"pkg:pypi/docling","ranges":[">=2.107.0 <2.120.3"],"fixed":["2.120.3"]}]},{"id":"PYSEC-2026-4207","url":"https://osv.dev/vulnerability/PYSEC-2026-4207","summary":"Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend","modified":"2026-10-15T14:45:04.351743500Z","packages":[{"ecosystem":"PyPI","name":"docling","purl":"pkg:pypi/docling","ranges":[">=2.107.0 <2.120.3"],"fixed":["2.120.3"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}