{"id":"CVE-2026-112310","title":"docling-core through 2.102.0 Local File Disclosure via Plain Path ImageRef","summary":"docling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit cr…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-73"],"vendor":"docling-project","product":"docling-core","affected":["docling-core <= 2.102.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-19T17:37:11.808325Z"},"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T17:37:34.611Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112310","references":[{"url":"https://github.com/docling-project/docling-core/pull/900"},{"url":"https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/common/reference.py"},{"url":"https://github.com/docling-project/docling-core/blob/v2.102.0/docling_core/types/doc/document.py"},{"url":"https://www.vulncheck.com/advisories/docling-core-through-2.102.0-local-file-disclosure-via-plain-path-imageref","label":"VulnCheck Advisory: docling-core through 2.102.0 Local File Disclosure via Plain Path ImageRef"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T16:32:30.080Z","slug":"CVE-2026-112310","body":"## Overview\n\ndocling-core through 2.102.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.\n\n## Affected\n\n- `docling-core <= 2.102.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}