{"id":"CVE-2026-112310","kind":"vulnerability","aliases":["CVE-2026-112310"],"related":[],"title":"docling-core: crafted document files read arbitrary local images","description":"docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.","summary":"docling-core versions from 2.5.0 before 2.103.0 accept plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri check. An attacker who supplies a crafted DoclingDocument JSON or YAML file can get local image files embedded as base64 on export or HTML rendering, which also reveals whether paths exist.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docling","document-processing","package","python"],"not_affected_if":["no-embedded-export","no-untrusted-documents"],"how_to_check":"- Run `pip show docling-core` and check whether the version is below `2.103.0`.\n- Search your code for `ImageRefMode.EMBEDDED` or HTML rendering of documents that come from untrusted users.","fix":"- Upgrade docling-core to `2.103.0` or later.","status":"open","published_at":"2026-10-19T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:02+00:00","updated_at":"2026-10-25T04:25:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:25:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade docling-core to `2.103.0` or later.","reach":"internet","title":"docling-core: crafted document files read arbitrary local images","impact":"medium","summary":"docling-core versions from 2.5.0 before 2.103.0 accept plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri check. An attacker who supplies a crafted DoclingDocument JSON or YAML file can get local image files embedded as base64 on export or HTML rendering, which also reveals whether paths exist.","category":"package","nicknames":[],"who_cares":["python","docling","document-processing"],"confidence":0.6,"needs_auth":"no","worst_case":"local image files readable by the attacker as base64","analyst_note":"","how_to_check":"- Run `pip show docling-core` and check whether the version is below `2.103.0`.\n- Search your code for `ImageRefMode.EMBEDDED` or HTML rendering of documents that come from untrusted users.","needs_analyst":false,"not_affected_if":["no-untrusted-documents","no-embedded-export"],"who_is_affected":"Applications that parse untrusted DoclingDocument JSON or YAML and then export it with embedded images or render it to HTML are exposed, because the crafted file can pull local files into the output. Systems that only process documents they create themselves, or that never export embedded images, are much less exposed. unknown whether the sources list other affected paths.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000605,"input_tokens":3379,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112310':13A,16A '-2026':12A,15A '2.103.0':30B,80C '2.5.0':28B,78C 'accept':31B 'allow':40B,88C,104C 'also':70B 'arbitrari':8A 'attack':46B,89C,109C 'base64':63B,132C 'bypass':38B,102C 'check':44B 'contain':81C 'core':3A,25B,77C 'craft':4A,50B,112C 'cve':11A,14A 'disclosur':85C 'docl':2A,17B,24B,76C 'docling-cor':1A,23B,75C 'doclingdocu':51B,113C 'document':5A,19B 'document-process':18B 'emb':126C 'embed':61B 'exist':74B,136C 'export':65B,119C 'file':6A,42B,55B,60B,84C,106C,130C 'filesystem':33B,97C 'gate':108C 'get':57B 'html':67B,125C 'imag':10A,41B,59B,93C,105C,129C 'imageref':36B,100C 'imagerefmode.embedded':121C 'json':52B,114C 'local':9A,58B,83C,92C,128C 'packag':21B 'path':34B,73B,98C,135C 'plain':32B,96C 'process':20B 'python':22B 'read':7A,91C 'readabl':127C 'render':68B,123C 'reveal':71B,134C 'submit':111C 'suppli':48B,95C 'uri':37B,43B,101C,107C 'version':26B 'vulner':86C 'whether':72B 'yaml':54B,116C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse untrusted DoclingDocument JSON or YAML and then export it with embedded images or render it to HTML are exposed, because the crafted file can pull local files into the output. Systems that only process documents they create themselves, or that never export embedded images, are much less exposed. unknown whether the sources list other affected paths.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112310","severity":null,"published_at":"2026-10-19T16:17:07+00:00","modified_at":"2026-10-19T21:17:07+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}