CVE-2026-105748: Docling: Crafted DoclingDocument JSON embeds local image files into converted output
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting picture image references that contain local paths or file URIs. When the document is enriched or exported with ImageRefMode.EMBEDDED, the DoclingDocument.withembeddedpictures and ImageRef.pilimage methods can open those references and place readable image bytes in Markdown or HTML output. Disclosure is limited to files Pillow can decode as images, while differing decode behavior can also reveal whether a path exists. Direct untrusted loading through docling-core is outside this Docling fix. This issue is fixed in 2.131.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Doclingto a version that resolves this vulnerability.Fixed in 2.131.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Docling versions from 2.16.0 before 2.131.0 are exposed when they load serialized DoclingDocument JSON through the InputFormat.JSON_DOCLING backend and subsequently enrich or export it with ImageRefMode.EMBEDDED. Direct untrusted loading through docling-core is outside the scope of this Docling fix.
What must an attacker provide to exploit it?
An attacker needs to get a crafted serialized DoclingDocument JSON processed by the affected JSON backend. The document must contain picture image references using local paths or file URIs, and the application must perform an embedded-image enrichment or export operation.
What information can be disclosed?
Readable bytes from local files that Pillow can decode as images can be embedded into generated Markdown or HTML output. Differences in image decoding behavior may also disclose whether a referenced path exists.
What should be done if patching is not immediately possible?
Do not process untrusted serialized DoclingDocument JSON with the InputFormat.JSON_DOCLING backend where embedded-image enrichment or export is enabled. Avoid ImageRefMode.EMBEDDED for such inputs until upgrading.
How is the issue fixed?
Upgrade Docling to version 2.131.0, which fixes the validation issue for picture image references in serialized DoclingDocument input.