CVE-2026-105749

In Docling from 2.107.0 until 2.120.3, the OpenDocument backend uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting, allowing local files to be embedded in converted output.

In Docling from 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed.

In Docling from 2.16.0 until 2.131.0, the InputFormat.JSON_DOCLING backend does not reject picture image references containing local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, DoclingDocument methods can open those references and place readable image bytes in Markdown or HTML output.

In Docling from 2.45.0 until 2.131.0, METS-GBS format detection and the backend call tarfile.TarFile.getmembers() before enforcing the max_member_count limit, causing the full archive member list to be allocated before the limit can stop processing. A small gzip-compressed tar archive with a very large number of empty members can consume memory proportional to the declared member count.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker.

In Docling from 2.27.0 until 2.131.0, plugin factories call load_setuptools_entrypoints() before applying the allow_external_plugins setting, so every module registered in the Docling entry-point group is imported even when external plugins are disabled. An installed malicious package can execute import-time code when Docling starts.

Docling from 2.94.0 until 2.132.0, when callers opt into LatexBackendOptions(tikz_engine="tectonic"), compiles an untrusted TikZ body and document preamble without restricting TeX file primitives including \openin and \openout. Crafted input can read files available to the converter and create or overwrite writable files, and enabling the tikz_engine_allow_shell_escape option additionally permits shell commands through TeX. The default configuration, which does not enable Tectonic rendering, is not affected.

In Docling from 2.91.0 until 2.132.0, validate_url_safety validates a hostname with a single IPv4 lookup and then allows the HTTP client to resolve and parse the original URL again, permitting DNS rebinding, mixed public and internal address records, and backslash authority parser disagreement to reach internal services. HTMLBackendOptions(render_page=True) also allows HTTP and HTTPS browser requests without validating their resolved destination.

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required.

In Docling prior to version 2.94.0, unsafe URI and path handling was found in the HTML backend. This vulnerability could allow an attacker to perform unauthorized operations on files or network resources.