CVE-2026-71428: unstructured: Server-Side Request Forgery in the URL-based partitioning
The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. From 0.4.7 until 0.24.0, the url argument of partition, partitionhtml, and partitionmd is fetched without host validation in unstructured/partition/auto.py, unstructured/partition/html/partition.py, and unstructured/partition/md.py. An attacker who controls that URL can make a server-side ingestion service request loopback addresses, internal HTTP services, or cloud metadata endpoints through direct targets, redirects, or DNS rebinding. The response body is returned as Element text, allowing internal response disclosure, and side-effecting GET endpoints may also be triggered. This issue is fixed in version 0.24.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
unstructuredto a version that resolves this vulnerability.Fixed in 0.24.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using unstructured versions from 0.4.7 through versions before 0.24.0 are exposed if they pass attacker-controlled URLs to partition, partition_html, or partition_md. A server-side ingestion service is particularly at risk because it can reach loopback, internal HTTP, or cloud metadata endpoints.
What does an attacker need to exploit this issue?
The attacker needs control over a URL supplied to one of the affected partitioning functions. No authentication or user interaction is required, and the URL can target internal services directly or through redirects or DNS rebinding.
What can an attacker obtain or do through the vulnerable request?
Internal HTTP response bodies can be disclosed because returned content is represented as Element text. Requests can also invoke side-effecting GET endpoints on reachable internal services.
What should be done if upgrading is not immediately possible?
Do not allow untrusted users to control URLs passed to the affected partitioning functions. Restrict the ingestion service's network access to prevent requests to loopback addresses, internal HTTP services, and cloud metadata endpoints.
How is the issue fixed?
Upgrade unstructured to version 0.24.0, which fixes the missing host validation for the affected URL-based partitioning paths.