CVE-2026-44023

HighCVSS 8.6

Published: 16/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

Docling Core versions 1.5.0 through 2.74.1 insufficiently restricted remote request destinations and unsafely processed Content-Disposition headers, allowing access to local files outside the cache directory. This vulnerability enables SSRF attacks in applications that accept untrusted URLs.

Risk Assessment

The organization is at risk of local sensitive data exposure and potential SSRF escalation, leading to unauthorized file system access.

Recommendation

Immediately update Docling Core to version 2.74.1 or later, and restrict acceptance of untrusted URLs in applications using this library.

Other vulnerabilities in Docling Core

CVE-2026-44019High
A vulnerability in Docling Core (versions 2.5.0 through 2.74.0) allows local file:// image references and accepts inline data: content without a decoded-size limit. This may lead to unauthorized file access or excessive memory consumption.

Original NVD description (English source)

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.