MEDIUM

CVE-2026-44022

Docling Docling 2026-06-24 CVSS v3.1

CVSS

5.5

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \includegraphics, \input, and \include commands lacked path containment validation. Attackers could craft malicious LaTeX documents with path traversal sequences to read arbitrary files from the file system accessible to the process, include sensitive files in the converted document output, or potentially access configuration files, credentials, or other sensitive data This vulnerability is fixed in 2.91.0.

Weakness (CWE)

CWE-22 Path Traversal

EPSS Score

0.21%

Probability of exploitation in next 30 days

11.2th percentile

References

https://github.com/docling-project/docling/releases/tag/v2.91.0 Product, Release Notes https://github.com/docling-project/docling/security/advisories/GHSA-2j5p-7p5m-cvqr Mitigation, Patch, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE