Vulnerability-Lookup

CVE-2026-105750 (GCVE-0-2026-105750)

Vulnerability from cvelistv5 – Published: 2026-10-05 21:38 – Updated: 2026-10-05 21:38

Title

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Summary

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-552 - Files or Directories Accessible to External Parties
CWE-863 - Incorrect Authorization

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/docling-project/docling/securi…	x_refsource_CONFIRM
https://github.com/docling-project/docling/pull/3948	x_refsource_MISC
https://github.com/docling-project/docling/commit…	x_refsource_MISC
https://github.com/docling-project/docling/releas…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
docling-project	docling	Affected: >= 2.82.0, < 2.118.1	guessed
docling-project	docling-slim	Affected: >= 2.92.0, < 2.118.1	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "docling",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.82.0, \u003c 2.118.1"
            }
          ]
        },
        {
          "product": "docling-slim",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.92.0, \u003c 2.118.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552: Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T21:38:28.098Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm"
        },
        {
          "name": "https://github.com/docling-project/docling/pull/3948",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/pull/3948"
        },
        {
          "name": "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a"
        },
        {
          "name": "https://github.com/docling-project/docling/releases/tag/v2.118.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/releases/tag/v2.118.1"
        }
      ],
      "source": {
        "advisory": "GHSA-q43m-vhcp-mhvm",
        "discovery": "UNKNOWN"
      },
      "title": "Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105750",
    "datePublished": "2026-10-05T21:38:28.098Z",
    "dateReserved": "2026-10-05T19:11:07.947Z",
    "dateUpdated": "2026-10-05T21:38:28.098Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-105750",
      "date": "2026-10-06",
      "epss": "0.003",
      "percentile": "0.20777"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "docling",
                "vendor": "docling-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.82.0, \u003c 2.118.1"
                  }
                ]
              },
              {
                "product": "docling-slim",
                "vendor": "docling-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.92.0, \u003c 2.118.1"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1."
          }
        ],
        "id": "CVE-2026-105750",
        "lastModified": "2026-10-06T14:59:48.280",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-05T22:16:58.097",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/pull/3948"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/releases/tag/v2.118.1"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-552"
              },
              {
                "lang": "en",
                "value": "CWE-863"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-06T00:10:44+00:00",
      "cve": "CVE-2026-105750",
      "id": "CVE-2026-105750",
      "initial_release_date": "2026-10-05T21:38:28.098000+00:00",
      "product_status:known_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "docling: docling: Information disclosure via unrestricted local file requests in HTML rendering",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105750.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-105750

Vulnerability from fkie_nvd - Published: 2026-10-05 22:16 - Updated: 2026-10-06 14:59

Severity

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a
	security-advisories@github.com	https://github.com/docling-project/docling/pull/3948
	security-advisories@github.com	https://github.com/docling-project/docling/releases/tag/v2.118.1
	security-advisories@github.com	https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "docling",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.82.0, \u003c 2.118.1"
            }
          ]
        },
        {
          "product": "docling-slim",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.92.0, \u003c 2.118.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1."
    }
  ],
  "id": "CVE-2026-105750",
  "lastModified": "2026-10-06T14:59:48.280",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-05T22:16:58.097",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/pull/3948"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.118.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        },
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-Q43M-VHCP-MHVM

Vulnerability from github – Published: 2026-10-06 00:02 – Updated: 2026-10-06 00:02

Summary

Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

Details

Summary

When the HTML backend renders pages in a headless browser (HTMLBackendOptions(render_page=True)), the enable_local_fetch option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with <iframe src="file:///...">), and that file's contents appear in the page image attached to the returned DoclingDocument.

Details

In render mode, Playwright requests are filtered by HTMLDocumentBackend._get_browser_request_block_reason. In affected versions, this check allowed file: URLs unconditionally, before reading any option. As a result:

enable_local_fetch=False did not block local file access, and
even with enable_local_fetch=True, file access was not limited to the source document's directory, unlike the non-render path (ImageResourceLoader), which rejects absolute paths and path traversal.

Versions 2.82.0–2.90.x did no request filtering in render mode at all.

The browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image.

Only Path inputs are affected. They are loaded through a file:// URL. Stream inputs are loaded with page.set_content() into an opaque origin, from which Chromium does not load file:// subresources.

Impact

An attacker who can submit HTML for conversion can read any text file the conversion process can read (for example .env files, credential files, or other users' documents on a shared host) by having it rendered into the page image.

Only applications that meet all of these conditions are affected:

they set HTMLBackendOptions(render_page=True) in Python,
they have the optional playwright dependency installed, and
they pass untrusted HTML as a filesystem Path.

The following are not affected: the default configuration (render_page=False), the docling CLI, docling-serve, and the EPUB, Markdown, XBRL and email backends.

Patches

Fixed in 2.118.1 (#3948). In render mode, file: requests are now blocked unless enable_local_fetch=True, and allowed requests are limited to the source document's directory.

Workarounds

If you can't upgrade, don't use render_page=True on untrusted HTML, or pass the input as a stream instead of a Path.

Credits

Reported by @priyankn.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.82.0"
            },
            {
              "fixed": "2.118.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling-slim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.92.0"
            },
            {
              "fixed": "2.118.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-105750"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-552",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T00:02:27Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `enable_local_fetch` option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with `\u003ciframe src=\"file:///...\"\u003e`), and that file\u0027s contents appear in the page image attached to the returned `DoclingDocument`.\n\n### Details\n\nIn render mode, Playwright requests are filtered by `HTMLDocumentBackend._get_browser_request_block_reason`. In affected versions, this check allowed `file:` URLs unconditionally, before reading any option. As a result:\n\n- `enable_local_fetch=False` did not block local file access, and\n- even with `enable_local_fetch=True`, file access was not limited to the source document\u0027s directory, unlike the non-render path (`ImageResourceLoader`), which rejects absolute paths and path traversal.\n\nVersions 2.82.0\u20132.90.x did no request filtering in render mode at all.\n\nThe browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image.\n\nOnly `Path` inputs are affected. They are loaded through a `file://` URL. Stream inputs are loaded with `page.set_content()` into an opaque origin, from which Chromium does not load `file://` subresources.\n\n### Impact\n\nAn attacker who can submit HTML for conversion can read any text file the conversion process can read (for example `.env` files, credential files, or other users\u0027 documents on a shared host) by having it rendered into the page image.\n\nOnly applications that meet **all** of these conditions are affected:\n\n- they set `HTMLBackendOptions(render_page=True)` in Python,\n- they have the optional `playwright` dependency installed, and\n- they pass untrusted HTML as a filesystem `Path`.\n\nThe following are **not** affected: the default configuration (`render_page=False`), the `docling` CLI, `docling-serve`, and the EPUB, Markdown, XBRL and email backends.\n\n### Patches\n\nFixed in **2.118.1** (#3948). In render mode, `file:` requests are now blocked unless `enable_local_fetch=True`, and allowed requests are limited to the source document\u0027s directory.\n\n### Workarounds\n\nIf you can\u0027t upgrade, don\u0027t use `render_page=True` on untrusted HTML, or pass the input as a stream instead of a `Path`.\n\n### Credits\n\nReported by @priyankn.",
  "id": "GHSA-q43m-vhcp-mhvm",
  "modified": "2026-10-06T00:02:27Z",
  "published": "2026-10-06T00:02:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/pull/3948"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.118.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-105750 (GCVE-0-2026-105750)

FKIE_CVE-2026-105750

GHSA-Q43M-VHCP-MHVM

Summary

Details

Impact

Patches

Workarounds

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour