CVE-2026-47214

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47214
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47214.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47214
Aliases
Published
2026-06-26T15:45:04.659Z
Modified
2026-07-15T01:49:00.367167670Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L CVSS Calculator
Summary
Docling: Unsafe URI and Path Handling in HTML Backend
Details

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47214.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400",
        "CWE-73"
    ]
}
References

Affected packages

Git / github.com/docling-project/docling

Affected ranges

Type
GIT
Repo
https://github.com/docling-project/docling
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
9816f85228a6d3d34cc4beaec0ee7356c7d0bf43
Database specific 
{
    "cpe": "cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.94.0"
        }
    ]
}

Affected versions

v0.*
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.10.0
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.13.1
v1.14.0
v1.15.0
v1.16.0
v1.16.1
v1.17.0
v1.18.0
v1.19.0
v1.19.1
v1.2.0
v1.2.1
v1.20.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.7.0
v1.7.1
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.11.0
v2.12.0
v2.13.0
v2.14.0
v2.15.0
v2.15.1
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.2.0
v2.2.1
v2.20.0
v2.21.0
v2.22.0
v2.23.0
v2.23.1
v2.24.0
v2.25.0
v2.25.1
v2.25.2
v2.26.0
v2.27.0
v2.28.0
v2.28.1
v2.28.2
v2.28.3
v2.28.4
v2.29.0
v2.3.0
v2.3.1
v2.30.0
v2.31.0
v2.31.1
v2.31.2
v2.32.0
v2.33.0
v2.34.0
v2.35.0
v2.36.0
v2.36.1
v2.37.0
v2.38.0
v2.38.1
v2.39.0
v2.4.0
v2.4.1
v2.4.2
v2.40.0
v2.41.0
v2.42.0
v2.42.1
v2.42.2
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.47.0
v2.47.1
v2.48.0
v2.49.0
v2.5.0
v2.5.1
v2.5.2
v2.50.0
v2.51.0
v2.52.0
v2.53.0
v2.54.0
v2.55.0
v2.55.1
v2.56.0
v2.56.1
v2.57.0
v2.58.0
v2.59.0
v2.6.0
v2.60.0
v2.60.1
v2.61.0
v2.61.1
v2.61.2
v2.62.0
v2.63.0
v2.64.0
v2.64.1
v2.65.0
v2.66.0
v2.67.0
v2.68.0
v2.69.0
v2.69.1
v2.7.0
v2.7.1
v2.70.0
v2.71.0
v2.72.0
v2.73.0
v2.73.1
v2.74.0
v2.75.0
v2.76.0
v2.77.0
v2.78.0
v2.79.0
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.80.0
v2.81.0
v2.82.0
v2.83.0
v2.84.0
v2.85.0
v2.86.0
v2.87.0
v2.88.0
v2.89.0
v2.9.0
v2.90.0
v2.90.1
v2.91.0
v2.92.0
v2.93.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47214.json"