CVE-2026-105751 in Docling
Summary
by MITRE • 10/06/2026
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified within Docling versions ranging from 2.107.0 to 2.120.3 represents a critical server-side path traversal and arbitrary file inclusion flaw rooted in the OpenDocument format backend processing logic. Specifically, the function _image_ref_from_odf_image located in docling/backend/opendocument_backend.py fails to properly validate user-controlled input derived from ODF document structures. When an attacker crafts a malicious OpenDocument file containing a draw:image element with an xlink:href attribute pointing to a local filesystem path rather than a valid internal archive reference, the backend attempts to resolve this external resource directly on the host system's disk. This behavior deviates significantly from secure design principles which mandate that resources referenced within document files should either be contained within the package or fetched via controlled network protocols with strict validation mechanisms in place.
The technical core of this vulnerability lies in the absence of fundamental security controls during path resolution. The code does not perform a scheme check to ensure the reference is internal, nor does it apply extraction-directory confinement to restrict file access to specific safe directories. Furthermore, unlike other backends within the same ecosystem that utilize an enable_local_fetch setting to explicitly gate local resource access, this particular backend proceeds with reading the path without such safeguards. Consequently, if Pillow, the image processing library used by Docling, can decode a file at the specified location as an image format, it will be embedded into the converted output document. This mechanism allows for both information disclosure and potential denial of service scenarios depending on how the resulting data is handled downstream in the application pipeline.
From an operational impact perspective, this flaw enables remote attackers to read arbitrary files from the server's filesystem where Docling is deployed. By leveraging common file paths such as /etc/passwd or configuration files containing sensitive credentials, an attacker can exfiltrate critical system information. The ability to distinguish existing paths through attempted reads also facilitates directory enumeration and fingerprinting of the underlying operating environment. This capability significantly expands the attack surface for subsequent exploitation phases, potentially leading to full server compromise if combined with other vulnerabilities in the surrounding application architecture. Such behavior aligns closely with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-94 Improper Control of Generation of Code (Code Injection), as it allows external input to dictate file system operations without adequate sanitization or restriction.
Mitigation strategies for this vulnerability involve immediate upgrading to version 2.120.3 where the issue has been resolved by implementing proper validation checks on xlink:href attributes and enforcing strict confinement rules similar to those used in other backends. For environments unable to upgrade immediately, administrators should ensure that Docling operates within a restricted container or sandboxed environment with minimal filesystem permissions. Additionally, input validation at the ingestion layer can help filter out malformed ODF documents before they reach the parsing backend. Monitoring logs for unusual file access patterns related to image processing components may also aid in detecting attempted exploitation activities. This incident underscores the importance of adhering to ATT&CK technique T1083 File and Directory Discovery when designing document parsers, ensuring that all external references are treated as untrusted input requiring rigorous validation before any system interaction occurs.