All vulnerabilities
CVE-2026-105748GHSA-p944-4xh2-x776PYSEC-2026-4208PYSEC-2026-4213

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

docling-project doclingpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.131.0Fixed versionGitHub
Published5 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

  • 2.131.0docling, pipGitHub
  • 2.131.0docling-slim, pipGitHub
  • 2.131.0docling, PyPIOSVpip install "docling>=2.131.0"
  • 2.131.0docling-slim, PyPIOSVpip install "docling-slim>=2.131.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

docling accepts serialized DoclingDocument JSON as an input format (InputFormat.JSON_DOCLING, enabled by default). A crafted JSON file can set a picture's image uri to a local file path. When the converted document is exported with embedded images (ImageRefMode.EMBEDDED, the CLI default for Markdown and HTML), the referenced file is read and embedded as base64 in the output.

Details

docling/backend/json/docling_json_backend.py validates the JSON into a DoclingDocument without checking image references. The file is then read by docling-core:

  • DoclingDocument._with_embedded_pictures opens file:// and plain-path URIs with PIL.
  • ImageRef.pil_image checks allow_image_file_uri for file:// URIs but not for plain Path values. docling's picture enrichment models load images through this property.

Only files that PIL can decode as an image are disclosed. Other files, such as text files or keys, fail to decode and are not embedded. The different error behaviour does reveal whether a path exists.

Impact

Disclosure of image files readable by the converting process (for example other users' uploads or page images in a shared service), and disclosure of whether a local path exists.

Proof of concept

from pathlib import Path
from docling_core.types.doc import DoclingDocument, ImageRef
from docling_core.types.doc.base import Size

doc = DoclingDocument(name="poc")
doc.add_picture(image=ImageRef(mimetype="image/png", dpi=72, size=Size(width=1, height=1),
                               uri=Path("/srv/uploads/other-user/scan.png")))
doc.save_as_json("poc.json")

docling poc.json --to md embeds the referenced PNG as base64 in poc.md.

Patches

Fixed in docling 2.131.0 by #4417. The Docling JSON backend now drops image references that point at local files (paths, file: URIs and any scheme other than data: and http(s)) and logs a warning. Callers that need to load local images from JSON they trust can opt in with DoclingJSONFormatOption(backend_options=DeclarativeBackendOptions(enable_local_fetch=True)); the CLI has no such option.

Code that loads untrusted JSON directly with docling-core (DoclingDocument.load_from_json) and exports it with embedded images is not covered by this fix; that part is tracked in docling-core.

Workarounds

Upgrade to 2.131.0. For older versions:

  • Remove InputFormat.JSON_DOCLING from allowed_formats when converting untrusted input.
  • Export with ImageRefMode.PLACEHOLDER or ImageRefMode.REFERENCED instead of EMBEDDED.

Text from GitHub Advisory Database

Affected versions 102

  • docling, pip>= 2.16.0, < 2.131.0GitHub
  • docling-slim, pip>= 2.92.0, < 2.131.0GitHub
  • doclingaffected: >= 2.16.0, < 2.131.0CVE List
  • docling-slimaffected: >= 2.16.0, < 2.131.0CVE List
  • docling, PyPIfrom 2.16.0, fixed in 2.131.0OSV
  • docling, PyPI2.100.0OSV
  • docling, PyPI2.101.0OSV
  • docling, PyPI2.102.0OSV
  • docling, PyPI2.102.1OSV
  • docling, PyPI2.102.2OSV
  • docling, PyPI2.103.0OSV
  • docling, PyPI2.104.0OSV
  • docling, PyPI2.105.0OSV
  • docling, PyPI2.106.0OSV
  • docling, PyPI2.107.0OSV
  • docling, PyPI2.108.0OSV
  • docling, PyPI2.109.0OSV
  • docling, PyPI2.110.0OSV
  • docling, PyPI2.111.0OSV
  • docling, PyPI2.112.0OSV
  • docling, PyPI2.113.0OSV
  • docling, PyPI2.114.0OSV
  • docling, PyPI2.115.0OSV
  • docling, PyPI2.116.0OSV
  • docling, PyPI2.117.0OSV
  • docling, PyPI2.118.0OSV
  • docling, PyPI2.118.1OSV
  • docling, PyPI2.119.0OSV
  • docling, PyPI2.120.1OSV
  • docling, PyPI2.120.2OSV
  • docling, PyPI2.120.3OSV
  • docling, PyPI2.121.0OSV
  • docling, PyPI2.122.0OSV
  • docling, PyPI2.123.0OSV
  • docling, PyPI2.123.1OSV
  • docling, PyPI2.124.0OSV
  • docling, PyPI2.125.0OSV
  • docling, PyPI2.126.0OSV
  • docling, PyPI2.127.0OSV
  • docling, PyPI2.128.0OSV
  • docling, PyPI2.129.0OSV
  • docling, PyPI2.130.0OSV
  • docling, PyPI2.16.0OSV
  • docling, PyPI2.17.0OSV
  • docling, PyPI2.18.0OSV
  • docling, PyPI2.19.0OSV
  • docling, PyPI2.20.0OSV
  • docling, PyPI2.21.0OSV
  • docling, PyPI2.22.0OSV
  • docling, PyPI2.23.0OSV
  • docling, PyPI2.23.1OSV
  • docling, PyPI2.24.0OSV
  • docling, PyPI2.25.0OSV
  • docling, PyPI2.25.1OSV
  • docling, PyPI2.25.2OSV
  • docling-slim, PyPIfrom 2.92.0, fixed in 2.131.0OSV
  • docling-slim, PyPI2.100.0OSV
  • docling-slim, PyPI2.101.0OSV
  • docling-slim, PyPI2.102.0OSV
  • docling-slim, PyPI2.102.1OSV
  • docling-slim, PyPI2.102.2OSV
  • docling-slim, PyPI2.103.0OSV
  • docling-slim, PyPI2.104.0OSV
  • docling-slim, PyPI2.105.0OSV
  • docling-slim, PyPI2.106.0OSV
  • docling-slim, PyPI2.107.0OSV
  • docling-slim, PyPI2.108.0OSV
  • docling-slim, PyPI2.109.0OSV
  • docling-slim, PyPI2.110.0OSV
  • docling-slim, PyPI2.111.0OSV
  • docling-slim, PyPI2.112.0OSV
  • docling-slim, PyPI2.113.0OSV
  • docling-slim, PyPI2.114.0OSV
  • docling-slim, PyPI2.115.0OSV
  • docling-slim, PyPI2.116.0OSV
  • docling-slim, PyPI2.117.0OSV
  • docling-slim, PyPI2.118.0OSV
  • docling-slim, PyPI2.118.1OSV
  • docling-slim, PyPI2.119.0OSV
  • docling-slim, PyPI2.120.1OSV
  • docling-slim, PyPI2.120.2OSV
  • docling-slim, PyPI2.120.3OSV
  • docling-slim, PyPI2.121.0OSV
  • docling-slim, PyPI2.122.0OSV
  • docling-slim, PyPI2.123.0OSV
  • docling-slim, PyPI2.123.1OSV
  • docling-slim, PyPI2.124.0OSV
  • docling-slim, PyPI2.125.0OSV
  • docling-slim, PyPI2.126.0OSV
  • docling-slim, PyPI2.127.0OSV
  • docling-slim, PyPI2.128.0OSV
  • docling-slim, PyPI2.129.0OSV
  • docling-slim, PyPI2.130.0OSV
  • docling-slim, PyPI2.92.0OSV
  • docling-slim, PyPI2.93.0OSV
  • docling-slim, PyPI2.94.0OSV
  • docling-slim, PyPI2.95.0OSV
  • docling-slim, PyPI2.96.0OSV
  • docling-slim, PyPI2.96.1OSV
  • docling-slim, PyPI2.97.0OSV
  • docling-slim, PyPI2.98.0OSV
  • docling-slim, PyPI2.99.0OSV

References 6