---
id: "CVE-2026-47214"
kind: "vulnerability"
aliases: ["CVE-2026-47214", "GHSA-q29v-xc37-wh5m"]
title: "Docling: Unsafe URI and Path Handling in HTML Backend"
severity: "high"
cvss: 7.1
epss: 0.0037299999967217445
exploited: false
status: "open"
category: "package"
products: [{"name": "docling", "fixed": ["2.94.0"], "affected": "< 2.94.0", "ecosystem": "pypi"}, {"name": "docling", "fixed": ["2.94.0"], "affected": "< 2.94.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["cwe-400", "cwe-73", "docling", "package", "python", "self-hosted"]
not_affected_if: ["default-config", "static-export"]
published_at: "2026-06-03T21:15:02+00:00"
first_seen_at: "2026-10-23T19:11:32+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-q29v-xc37-wh5m", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47214", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Docling: Unsafe URI and Path Handling in HTML Backend

Docling's HTML backend mishandled file:// URIs, relative and absolute paths, internal network addresses and redirects when local or remote fetching was enabled. An attacker who can supply an HTML document can read local files or reach internal network resources through the parser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:docling affected < 2.94.0 fixed 2.94.0
- vendor:docling affected < 2.94.0 fixed 2.94.0

## How to check

Run pip show docling and confirm the version is 2.94.0 or later.
Check whether enable_local_fetch=True or enable_remote_fetch=True is set in code that parses untrusted HTML.

## Fix

Upgrade docling to 2.94.0 or later.
Keep enable_local_fetch=False and enable_remote_fetch=False when processing untrusted HTML.

## Timeline

- 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-q29v-xc37-wh5m
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-47214

## From the sources

### Impact
The HTML backend did not perform sufficient validation during resource handling:
- Accepted `file://` URIs enabling local file system access when `enable_local_fetch=True`
- Path resolution allowed traversal outside intended directories via `../` sequences and absolute paths
- Did not block internal network resources under `enable_remote_fetch=True`
- HTTP redirects were not validated, potentially redirecting to unintended schemes
- No resource limits for remote image downloads and `data:` URIs

### Patches
Fixed in versions 2.91.0 (initial fixes) and 2.94.0 (additional improvements). The fixes implement:
- Updated local path treatment: absolute files always blocked, relative paths require `enable_local_fetch=True` (default: False) and containment within configured `base_path` for path traversal protection
- `file://` scheme stripped & treated as local path (above)
- IP address validation to prevent SSRF
- HTTP redirect validation, connection and read timeouts
- Size limit for both remote images (with streaming download) and base64-decoded data URIs

### Workarounds
Keep both `enable_local_fetch=False` and `enable_remote_fetch=False` (defaults) when processing untrusted HTML documents.

### References
- Initial fixes: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)
- Additional improvements: [v2.94.0](https://github.com/docling-project/docling/releases/tag/v2.94.0)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_