CVE-2026-47214: Docling: Unsafe URI and Path Handling in HTML Backend
(updated )
The HTML backend did not perform sufficient validation during resource handling:
- Accepted
file://URIs enabling local file system access whenenable_local_fetch=True - Path resolution allowed traversal outside intended directories via
../sequences and absolute paths - Did not block internal network resources under
enable_remote_fetch=True - HTTP redirects were not validated, potentially redirecting to unintended schemes
- No resource limits for remote image downloads and
data:URIs
References
- github.com/advisories/GHSA-q29v-xc37-wh5m
- github.com/docling-project/docling/pull/3400
- github.com/docling-project/docling/pull/3407
- github.com/docling-project/docling/releases/tag/v2.91.0
- github.com/docling-project/docling/releases/tag/v2.94.0
- github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5m
- github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2146.yaml
- nvd.nist.gov/vuln/detail/CVE-2026-47214
Code Behaviors & Features
Detect and mitigate CVE-2026-47214 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →