CVE-2026-112310

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112310
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112310.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112310
Aliases
  • GHSA-jx5c-6gmw-72m3
Published
2026-10-19T15:28:59Z
Modified
2026-10-21T02:55:52Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef
Details

docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-73"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112310.json"
}
References

Affected packages

Git / github.com/docling-project/docling-core

Affected ranges

Type
GIT
Repo
https://github.com/docling-project/docling-core
Events
Introduced
9fc97570e62d6a236eb5d622a5d212b06c3f1e55
Fixed
a1a81965908133e97101801416aa576bc4a26c0b
Fixed
f952fc5d4c68fb673043c7c9f9c4390052959517
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.5.0"
                },
                {
                    "fixed":  "2.103.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "f952fc5d4c68fb673043c7c9f9c4390052959517"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v2.103.0",
            "range":  [
                {
                    "fixed":  "a1a81965908133e97101801416aa576bc4a26c0b"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*
v2.10.0
v2.100.0
v2.101.0
v2.101.1
v2.102.0
v2.11.0
v2.12.0
v2.12.1
v2.13.0
v2.13.1
v2.14.0
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.17.0
v2.17.1
v2.17.2
v2.18.0
v2.18.1
v2.19.0
v2.19.1
v2.20.0
v2.21.0
v2.21.1
v2.21.2
v2.22.0
v2.23.0
v2.23.1
v2.23.2
v2.23.3
v2.24.0
v2.24.1
v2.25.0
v2.26.0
v2.26.1
v2.26.2
v2.26.3
v2.26.4
v2.27.0
v2.28.0
v2.28.1
v2.29.0
v2.30.0
v2.30.1
v2.31.0
v2.31.1
v2.31.2
v2.32.0
v2.33.0
v2.33.1
v2.34.0
v2.34.1
v2.34.2
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.38.1
v2.38.2
v2.39.0
v2.40.0
v2.41.0
v2.42.0
v2.43.0
v2.43.1
v2.44.0
v2.44.1
v2.44.2
v2.45.0
v2.46.0
v2.47.0
v2.48.0
v2.48.1
v2.48.2
v2.48.3
v2.48.4
v2.49.0
v2.5.0
v2.5.1
v2.50.0
v2.50.1
v2.51.0
v2.51.1
v2.52.0
v2.53.0
v2.54.0
v2.54.1
v2.55.0
v2.56.0
v2.57.0
v2.58.0
v2.58.1
v2.59.0
v2.6.0
v2.6.1
v2.60.0
v2.60.1
v2.60.2
v2.61.0
v2.62.0
v2.63.0
v2.64.0
v2.65.0
v2.65.1
v2.65.2
v2.66.0
v2.67.0
v2.67.1
v2.68.0
v2.69.0
v2.7.0
v2.7.1
v2.70.0
v2.70.1
v2.70.2
v2.71.0
v2.72.0
v2.73.0
v2.74.0
v2.74.1
v2.75.0
v2.76.0
v2.77.0
v2.77.1
v2.78.0
v2.78.1
v2.79.0
v2.8.0
v2.80.0
v2.81.0
v2.82.0
v2.83.0
v2.83.1
v2.84.0
v2.85.0
v2.86.0
v2.87.0
v2.87.1
v2.88.0
v2.89.0
v2.9.0
v2.90.0
v2.91.0
v2.92.0
v2.93.0
v2.94.0
v2.94.1
v2.95.0
v2.96.0
v2.96.1
v2.97.0
v2.97.1
v2.97.2
v2.98.0
v2.98.1
v2.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112310.json"