CVE-2026-112310 in docling-core
Summary
by MITRE • 10/19/2026
docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in docling-core versions through 2.102.0 represents a critical Local File Disclosure flaw rooted in the improper validation of Uniform Resource Identifiers within document processing workflows. This security issue specifically affects components responsible for handling image references, where the application fails to adequately sanitize or restrict input that specifies local filesystem paths. The core technical deficiency lies in the bypassing of the allow_image_file_uri gate, a security control designed to prevent access to resources outside permitted boundaries. By supplying plain filesystem paths within ImageRef URIs, an attacker can circumvent these restrictions, effectively tricking the application into treating arbitrary local files as valid image sources for embedding or rendering purposes.
From a technical perspective, this vulnerability exploits the parsing logic used when constructing DoclingDocument structures in JSON or YAML formats. When such crafted documents are processed with specific configurations like ImageRefMode.EMBEDDED or during HTML export operations, the system attempts to resolve and embed the referenced images. Instead of rejecting invalid or unauthorized paths, the application reads the content of local files on the host machine. The data is then encoded into base64 format and embedded directly into the output document structure. This mechanism allows for the exfiltration of sensitive file contents that were not intended to be part of the processed document, turning a standard document conversion feature into a vector for unauthorized data access.
The operational impact of this vulnerability is significant, particularly in environments where docling-core processes untrusted or user-supplied documents. An attacker with the ability to submit crafted input can read arbitrary local image files from the system running the application. Beyond direct content disclosure, the successful exploitation also reveals path existence, which aids in further reconnaissance and mapping of the target environment's file structure. This capability is particularly dangerous if the processing occurs on servers or workstations containing sensitive corporate data, personal information, or proprietary assets stored as local image files such as screenshots, diagrams, or scanned documents.
This flaw aligns with CWE-200, which categorizes exposure of sensitive information to an unauthorized actor, and falls under the ATT&CK technique T1537, involving file discovery through application behavior rather than direct system commands. The vulnerability highlights a common pitfall in web-centric frameworks applied to local processing tools: assuming that URI schemes imply network boundaries when they are actually being used for local resource inclusion without strict path validation.
Mitigation strategies must focus on enforcing strict input validation and restricting the scope of accessible resources. Developers should implement rigorous allow-listing mechanisms for file paths, ensuring that only files within designated directories can be accessed via ImageRef URIs. Path traversal sequences such as dot-dot-slash should be explicitly blocked or normalized to prevent directory climbing. Additionally, the application logic must verify that resolved absolute paths remain strictly within expected base directories before attempting any read operations. Upgrading to a patched version of docling-core where these validation gates are properly enforced is the primary remediation step for existing deployments until code-level fixes can be applied.