Vulnerability · Published Oct 5, 2026 · Assigned by GitHub_M
CVE-2026-105751Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
Medium 6.9
In plain English
A medium-severity path traversal in docling from docling-project. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced part is not found in the document archive. The _image_ref_from_odf_image function reads that attacker-controlled path without a scheme check, extraction-directory confinement, or the enable_local_fetch setting used by other backends. Readable files that Pillow can decode as images are embedded in converted output, and other existing paths can be distinguished through the attempted read. This issue is fixed in 2.120.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | docling | 2.120.3 | GHSA-4xhp-xg4w-8ppm |
| PyPI | docling | 2.120.3 | PYSEC-2026-4207 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| docling-project | docling | >= 2.107.0, < 2.120.3 |
Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
References
- https://github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm x_refsource_CONFIRM
- https://github.com/docling-project/docling/pull/4015 x_refsource_MISC
- https://github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311 x_refsource_MISC
- https://github.com/docling-project/docling/releases/tag/v2.120.3 x_refsource_MISC