{"id":"CVE-2026-112310","published":"2026-10-19T16:17:07.203","lastModified":"2026-10-19T21:17:07.210","description":"docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/common/reference.py","tags":[]},{"url":"https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/document.py","tags":[]},{"url":"https://github.com/docling-project/docling-core/commit/f952fc5d4c68fb673043c7c9f9c4390052959517","tags":[]},{"url":"https://github.com/docling-project/docling-core/pull/900","tags":[]},{"url":"https://github.com/docling-project/docling-core/releases/tag/v2.103.0","tags":[]},{"url":"https://github.com/docling-project/docling-core/security/advisories/GHSA-jx5c-6gmw-72m3","tags":[]},{"url":"https://www.vulncheck.com/advisories/docling-core-through-2.102.0-local-file-disclosure-via-plain-path-imageref","tags":[]}],"exploitRefs":[{"url":"https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/common/reference.py","tags":[]},{"url":"https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/document.py","tags":[]},{"url":"https://github.com/docling-project/docling-core/commit/f952fc5d4c68fb673043c7c9f9c4390052959517","tags":[]},{"url":"https://github.com/docling-project/docling-core/pull/900","tags":[]},{"url":"https://github.com/docling-project/docling-core/releases/tag/v2.103.0","tags":[]},{"url":"https://github.com/docling-project/docling-core/security/advisories/GHSA-jx5c-6gmw-72m3","tags":[]}],"hasPoc":true,"ai":null}