CVE-2026-44018: Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend

The METS-GBS backend’s XML parsing and the input document format detection lacked security controls, enabling:

• XML External Entity (XXE) attacks to read local files or cause denial of service
• Decompression bombs (zip bombs) to exhaust memory and disk space
• Unbounded archive extraction consuming system resources

An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes.