Description
docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.
Title docling-core through 2.102.0 Local File Disclosure via Plain Path ImageRef
First Time appeared Docling
Docling docling-core
Weaknesses CWE-73
CPEs cpe:2.3:a:docling:docling-core:*:*:*:*:*:*:*:*
Vendors & Products Docling
Docling docling-core
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Docling Docling-core
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T17:37:34.611Z

Reserved: 2026-10-19T14:14:29.771Z

Link: CVE-2026-112310

cve-icon Vulnrichment

Updated: 2026-10-19T17:37:25.929Z

cve-icon NVD

Status : Received

Published: 2026-10-19T16:17:07.203

Modified: 2026-10-19T18:17:05.370

Link: CVE-2026-112310

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T16:45:16Z

Weaknesses
  • CWE-73

    External Control of File Name or Path