Arexgodofwar

In the ODF backend, the software improperly handles the `xlink:href` attribute of a `draw:image` element. When a referenced part is not found within the document archive, the ` image ref from odf image` function in `docling/backend/opendocument backend.py` uses the attribute value as a filesystem path to read the file. This process occurs without scheme checks, extraction-directory confinement, or adherence to the `enable local fetch` and `enable remote fetch` settings used by other backends. An attacker can provide a crafted `.odt` file containing an absolute path in the `xlink:href` attribute. If the target file is one that Pillow can decode as an image, its full contents are embedded in the resulting `DoclingDocument` and disclosed in HTML, Markdown, and JSON exports. Additionally, the behavior allows for a silent file-existence oracle, as the system can distinguish between existing and non-existing paths on the host filesystem.

Insecure deserialization occurs when pretrained model checkpoints are loaded using the `torch.load` function with the `weights only` variable set to `False`. This allows arbitrary code execution if an attacker provides a specially crafted malicious checkpoint file. The issue can be triggered during the initialization or fine-tuning path, potentially granting an attacker full control over the system running the software.