CVE-2026-105751 · GHSA-4xhp-xg4w-8ppm
Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
- Risk score
- 66/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in th…
- Affected
- docling (pip) >= 2.107.0, < 2.120.3
- Fix
- Upgrade docling to 2.120.3 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
docling: Amber, patch this week. Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic") invoke docling/backend/latex/engines/tectonic.py to compile an untrusted TikZ body and document pre…
The flaws
- CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend (CVSS 7.5 · EPSS 0%)
- CVE-2026-105744: Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (CVSS 8.8 · EPSS 0%)
- CVE-2026-105750: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (CVSS 7.5 · EPSS 0%)
- CVE-2026-105749: Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion (CVSS 6.5 · EPSS 0%)
The fix
Upgrade docling: 2.120.3 · 2.132.0 · 2.118.1 · 2.131.0 or later on your release line
Who is exposed: docling (pip) >= 2.94.0, < 2.132.0; docling-slim (pip) >= 2.94.0, < 2.132.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Path traversal (CWE-22). 398 other warnings in 30 days
- Same product: Earlier docling warnings. 6 in the last 90 days
Why it is Amber
- CVSS 7.5 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
- On your watchlist: PyPI
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| docling | pip | >= 2.107.0, < 2.120.3 | 2.120.3 |
References
- https://github.com/advisories/GHSA-4xhp-xg4w-8ppm
- https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm
- https://github.com/docling-project/docling/pull/4015
- https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311
- https://github.com/docling-project/docling/releases/tag/v2.120.3
- https://github.com/advisories/GHSA-4xhp-xg4w-8ppm
Original description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.
Last activity 5 Oct 2026. Patch Forecast updates every hour.