Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.

Affected: PyPI: docling

## Summary The ODF backend resolves the `xlink:href` of a `draw:image` element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from `content.xml`, so it is document content, and it is used with no scheme check, no confinement to the extraction directory, and without consulting the `enable_local_fetch` / `enable_remote_fetch` controls that the other backends use for exactly this decision. Converting a crafted `.odt` therefore causes Docling to open an attacker-named absolute path on the converting host. Where the target decodes as an image, its complete contents are embedded in the resulting `DoclingDocument` and appear in the HTML, Markdown and JSON exports. Both the read and the disclosure are confirmed by execution. The trigger is a 452-byte archive containing two entries. ## Affected component `docling/backend/opendocument_backend.py`, in `_image_ref_from_odf_image`: ```python image_url = _odf_image_href(image) ... if image_data is None and odf_obj is not None and image_url: try: image_data = odf_obj.get_part(image_url) except Exception: image_data = None if image_data is None and image_url: image_path = Path(image_url) if image_path.is_file(): image_data = image_path.read_bytes() ``` `_odf_image_href` returns the `xlink:href` attribute. The in-archive lookup is attempted first; when it fails, the same string is handed to `Path` and read from disk.…