CVE-2026-112310
4.3 MEDIUMpublic exploit availablePublished 2026-10-19 · Updated 2026-10-19
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-73
Public exploit & PoC references
- https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/common/reference.py
- https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/document.py
- https://github.com/docling-project/docling-core/commit/f952fc5d4c68fb673043c7c9f9c4390052959517
- https://github.com/docling-project/docling-core/pull/900
- https://github.com/docling-project/docling-core/releases/tag/v2.103.0
- https://github.com/docling-project/docling-core/security/advisories/GHSA-jx5c-6gmw-72m3
All references
- https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/common/reference.py
- https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/document.py
- https://github.com/docling-project/docling-core/commit/f952fc5d4c68fb673043c7c9f9c4390052959517
- https://github.com/docling-project/docling-core/pull/900
- https://github.com/docling-project/docling-core/releases/tag/v2.103.0
- https://github.com/docling-project/docling-core/security/advisories/GHSA-jx5c-6gmw-72m3
- https://www.vulncheck.com/advisories/docling-core-through-2.102.0-local-file-disclosure-via-plain-path-imageref
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-100637PoC
- HIGHCVE-2026-100638PoC
- UNSCOREDCVE-2026-101126
- CRITICALCVE-2026-101148
- MEDIUMCVE-2026-102141PoC
- MEDIUMCVE-2026-102146PoC
- CRITICALCVE-2026-103255PoC
- HIGHCVE-2026-103398PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.