CVE-2026-105750 in Docling
Summary
by MITRE • 10/06/2026
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within Docling versions ranging from 2.82.0 to 2.118.1 represents a significant security flaw related to improper restriction of local resource access during document processing operations. This issue specifically affects the HTMLBackendOptions when configured with render_page set to True, allowing for the potential exfiltration or unauthorized reading of sensitive local files through crafted inputs. The core technical deficiency lies in the implementation of the HTMLDocumentBackend._get_browser_request_block_reason method, which fails to properly enforce the enable_local_fetch setting and does not confine local requests strictly to the directory of the source document. This oversight creates a pathway for attackers to manipulate file URLs within processed documents, leading to unintended access to the underlying filesystem where the application is executing.
From an operational perspective, this vulnerability enables a scenario where crafted path-backed HTML content can embed readable local text files into a browser-rendered page image when Playwright is installed as part of the processing environment. The attack vector relies on the ability to specify file URLs that bypass standard security boundaries typically enforced by web browsers or sandboxing mechanisms. By leveraging these malformed inputs, an adversary could potentially read arbitrary files from the server's filesystem, provided those files are accessible to the user account running the Docling process. This capability transforms a document processing tool into a potential vector for local information disclosure, compromising the confidentiality of data stored on the host system.
The scope of this vulnerability is limited primarily to inputs that utilize filesystem Path objects rather than stream-based inputs or other non-file sources. Stream inputs benefit from an opaque origin mechanism which inherently restricts access patterns and mitigates such risks. Furthermore, default configurations, command-line interface usage without specific rendering flags, the docling-serve application mode, and backends that do not perform page rendering remain unaffected by this flaw. This distinction is critical for risk assessment, as it indicates that only users explicitly configuring HTML backend options with page rendering enabled are exposed to this particular threat vector.
In terms of industry standards classification, this vulnerability aligns closely with CWE-200: Information Exposure and CWE-798: Use of Hard-coded Credentials if the accessed files contain sensitive data such as API keys or configuration secrets. It also relates to CWE-436: Interpretation Conflict, where the application's interpretation of a file path differs from the security model's expectations regarding local resource access. From an ATT&CK perspective, this behavior maps to T1083: File and Directory Discovery, as it allows for the enumeration and reading of files on the local system without proper authorization checks. The exploitation technique resembles aspects of Server-Side Request Forgery (SSRF) but is localized to file:// protocol abuse rather than arbitrary network requests.
Mitigation strategies must prioritize upgrading Docling to version 2.118.1 or later, where this issue has been resolved through stricter enforcement of local fetch restrictions and proper confinement of request scopes. For environments that cannot immediately upgrade, administrators should ensure that HTMLBackendOptions are not configured with render_page set to True unless absolutely necessary for specific use cases requiring visual rendering. Additionally, running Docling processes under restricted user accounts with minimal filesystem permissions can reduce the impact if an exploit is attempted. Implementing strict input validation to reject or sanitize file URLs in processed documents provides another layer of defense against this type of local resource abuse.