CVE-2026-112310: docling-core through 2.102.0 Local File Disclosure via Plain Path ImageRef
docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allowimagefileuri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.
Affected Software
Event History
Frequently Asked Questions
What deployment scenarios are exposed?
Applications using docling-core through 2.102.0 are exposed when they accept attacker-controlled DoclingDocument JSON or YAML and export it with ImageRefMode.EMBEDDED or render it to HTML. The issue concerns local image files readable by the process performing the export or rendering.
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted document containing a plain filesystem path in an ImageRef URI and induce the application to export or render that document. No authentication requirement is indicated by the provided CVSS vector, but user interaction is required.
Does disabling file URI support prevent exploitation?
No. Plain filesystem paths bypass the allow_image_file_uri gate, so disabling file URI handling alone does not prevent the described disclosure.
How can I determine whether disclosure may already have occurred?
Review submitted DoclingDocument JSON or YAML for ImageRef values containing plain filesystem paths, especially in documents subsequently exported with ImageRefMode.EMBEDDED or rendered to HTML. Resulting output may contain base64-embedded image data and can reveal whether referenced paths existed.