CVE-2026-105748
Description
A flaw was found in Docling. This vulnerability allows an attacker to cause an information disclosure by providing a crafted document containing image references that point to local file paths or URIs (Uniform Resource Identifiers). When the application processes and exports the document with embedded images, it can read the local files and embed their contents into output formats like Markdown or HTML. In addition, differences in processing behavior can reveal whether specific file paths exist on the underlying system.
Statement
A low impact information disclosure flaw was found in the Docling document conversion library, which Red Hat ships in Red Hat OpenShift AI (RHOAI) and Lightspeed Core container images. The InputFormat.JSON_DOCLING backend accepts serialized DoclingDocument JSON without rejecting picture image references that contain local paths or file URIs. When a crafted document is enriched or exported with embedded images (ImageRefMode.EMBEDDED, the default for Markdown and HTML output), Docling opens those references and embeds the readable file bytes into the output, disclosing local image files that Pillow can decode; differing decode behavior can also reveal whether a local path exists. Exploitation requires a user or application to process an attacker-supplied document, so Red Hat assesses this flaw as low severity with a local attack vector (CVSS 3.3), lower than the upstream rating of moderate severity (CVSS 4.3 with a network attack vector). Because the impact is low, fixes for the affected RHOAI and Lightspeed Core streams are deferred rather than scheduled for immediate update, and the RHOAI 3.3 stream is out of support scope. The residual risk is limited to disclosure of locally readable image files and local path existence in workloads that convert untrusted documents with embedded image export.
Mitigation
The upstream fix is available in docling 2.131.0, where the JSON_DOCLING backend drops image references that point at local files and logs a warning. For versions that cannot yet be upgraded, the upstream project documents these workarounds when processing untrusted input: remove InputFormat.JSON_DOCLING from the allowed_formats list so that serialized DoclingDocument JSON is not accepted, and export documents using ImageRefMode.PLACEHOLDER or ImageRefMode.REFERENCED instead of ImageRefMode.EMBEDDED so that referenced local files are not read and embedded into the output.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | N/A | 4.3 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Read Files or Directories; Modify Files or Directories
The application can operate on unexpected files. Confidentiality is violated when the targeted filename is not directly readable by the attacker.
Integrity,Confidentiality,Availability
Technical Impact: Modify Files or Directories; Execute Unauthorized Code or Commands
The application can operate on unexpected files. This may violate integrity if the filename is written to, or if the filename is for a program or other form of executable code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Other)
The application can operate on unexpected files. Availability can be violated if the attacker specifies an unexpected file that the application modifies. Availability can also be affected if the attacker specifies a filename for a large file, or points to a special device or a file that does not have the format that the application expects.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
