Local File Disclosure Vulnerability in Docling Core by Docling Project

CVE-2026-112310

What is CVE-2026-112310?

Docling Core versions up to 2.102.0 are susceptible to a local file disclosure vulnerability. This flaw allows attackers to exploit the system by injecting plain filesystem paths within ImageRef URIs. Consequently, attackers can craft malicious DoclingDocument in JSON or YAML formats that, when processed or converted to HTML, embeds sensitive local images as base64 strings. This unintended exposure can lead to the discovery of local file paths, compromising the integrity and confidentiality of the system. Users are urged to assess their deployment of Docling Core and apply necessary updates to safeguard against this significant vulnerability.

References