CVE-2026-105751: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend
The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever
the referenced part is not found inside the document archive. The value comes straight from
content.xml, so it is document content, and it is used with no scheme check, no confinement to
the extraction directory, and without consulting the enable_local_fetch / enable_remote_fetch
controls that the other backends use for exactly this decision.
Converting a crafted .odt therefore causes Docling to open an attacker-named absolute path on
the converting host. Where the target decodes as an image, its complete contents are embedded in
the resulting DoclingDocument and appear in the HTML, Markdown and JSON exports.
Both the read and the disclosure are confirmed by execution. The trigger is a 452-byte archive containing two entries.
References
- github.com/advisories/GHSA-4xhp-xg4w-8ppm
- github.com/docling-project/docling/commit/6ee9965adfc364b3696a67c825ec2f0d9cee4311
- github.com/docling-project/docling/pull/4015
- github.com/docling-project/docling/releases/tag/v2.120.3
- github.com/docling-project/docling/security/advisories/GHSA-4xhp-xg4w-8ppm
- nvd.nist.gov/vuln/detail/CVE-2026-105751
Code Behaviors & Features
Detect and mitigate CVE-2026-105751 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →