CVE-2026-112310

Name of the Vulnerable Software and Affected Versions docling-core versions 2.5.0 through 2.102.0

Description A local file disclosure issue exists where attackers can read local images by providing plain filesystem paths in ImageRef URIs, which bypasses the allow image file uri gate. This occurs when crafted DoclingDocument JSON or YAML is exported using ImageRefMode.EMBEDDED or rendered to HTML, resulting in the embedding of local image files as base64 and the disclosure of path existence.

Recommendations Update docling-core to version 2.103.0 or later.