CVE-2026-105750

A flaw was found in the docling HTML document backend that can lead to information disclosure, rated moderate severity by Red Hat. When HTML page rendering is enabled in Python via HTMLBackendOptions(render_page=True) and the optional playwright dependency is installed, the render-mode request filter (HTMLDocumentBackend._get_browser_request_block_reason) permits file: URLs unconditionally: it does not enforce the enable_local_fetch setting and does not confine local requests to the source document's directory. An attacker who can submit a crafted HTML file as a filesystem Path input can therefore cause any local text file readable by the conversion process (such as credentials or configuration files) to be embedded in the browser-rendered page image returned with the converted document. Applications are affected only when all of these conditions hold: render_page=True is set, playwright is installed, and untrusted HTML is passed as a filesystem Path. Stream inputs use an opaque origin from which local file subresources are not loaded, and the default configuration (render_page=False), the docling command-line interface, docling-serve, and the EPUB, Markdown, XBRL and email backends are not affected. Red Hat OpenShift AI and Lightspeed Core ship affected docling versions in container images; the fix is currently deferred for these products because the issue is rated moderate with a CVSSv3 score below the threshold used to prioritize updates. The residual risk is limited to deployments that enable HTML page rendering on untrusted Path-based input, where local file contents could be disclosed. Red Hat rates this issue moderate (CVSS 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) while NIST rates it important (7.5); the difference reflects Red Hat's assessment that exploitation requires a non-default configuration, an optional dependency, and Path-based input, which raises attack complexity.