CVE-2026-71428 in Unstructured
Summary
by MITRE • 08/20/2026
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partition_html, and partition_md is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The unstructured library serves as a critical open-source toolset for developers aiming to ingest and pre-process diverse document formats including PDFs, HTML files, Word documents, and markdown content. Within the specific versions ranging from 0.4.7 up to but not including 0.24.0, a significant security flaw exists in how external resources are handled during the parsing process. Specifically, the url argument utilized by functions such as partition, partition_html, and partition_md lacks adequate host validation logic within the core auto-partition module as well as the individual HTML and markdown partition modules. This architectural oversight allows an attacker who controls or influences the input URL to bypass standard security boundaries that are typically enforced in server-side ingestion services.
The technical nature of this vulnerability constitutes a Server-Side Request Forgery, commonly referred to by its CWE identifier CWE-918. The flaw arises because the library does not verify whether the target host is an internal or private address before initiating the HTTP request. Consequently, malicious actors can craft inputs that direct the server to make requests to loopback addresses like 127.0.0.1, access internal HTTP services residing on the same network segment, or interact with cloud metadata endpoints such as those found in AWS EC2 instances at 169.254.169.254. The exploitation mechanism is versatile, allowing attackers to achieve their goals through direct targeting of these internal IPs, leveraging HTTP redirects that point inward, or employing DNS rebinding techniques to bypass initial host checks by changing the IP address associated with a trusted domain during the connection lifecycle.
The operational impact of this vulnerability extends beyond simple information disclosure. Because the response body from these internal requests is returned as Element text within the parsed document structure, sensitive data residing on internal services can be exfiltrated directly through the application's output stream. This includes potential exposure of authentication tokens, private keys, or configuration details stored in cloud metadata services. Furthermore, if the targeted internal endpoints support side-effecting GET methods, an attacker may trigger unintended actions within those systems, effectively using the vulnerable server as a proxy to attack other components on the network. This behavior aligns with ATT&CK technique T1598, specifically Phishing for Information via Ingress Tool Transfer or similar lateral movement and reconnaissance patterns where internal services are abused to gather intelligence about the surrounding infrastructure.
To mitigate this risk, organizations utilizing versions of unstructured prior to 0.24.0 must upgrade immediately to version 0.24.0 or later, as these newer releases implement proper host validation checks that prevent requests to private and loopback address ranges. For environments where upgrading is not immediately feasible, implementing a network-level proxy with strict egress filtering can serve as an effective compensating control by blocking outbound connections to internal IP spaces from the application server. Additionally, developers should ensure that any custom wrappers around these partition functions enforce allow-listing of permitted domains and validate URLs against known private address ranges before passing them to the library. Regular security audits focusing on SSRF vulnerabilities in document processing pipelines are recommended to identify similar weaknesses in other components that handle external resource ingestion.