PT-2026-45850 · Unknown · Docling-Core

CVE-2026-44019 · Published 2026-06-02 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions docling-core versions 2.5.0 through 2.74.0

Description Insufficient input sanitization when processing specific documents allows for path traversal, enabling remote attackers to read arbitrary files from the host server. The software allows local file:// image references and accepts inline data: content without a decoded-size limit. In applications that accept untrusted image references, this can lead to the disclosure of local files readable by the process or excessive memory consumption due to large inline payloads.

Recommendations Upgrade to version 2.74.1 or later. As a temporary workaround, reject file: and data: image references from untrusted input. Allow only approved local or remote image sources. Apply input size and memory limits to processing workers.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-73

CWE-400

Related Identifiers

CVE-2026-44019

GHSA-J5XP-7M2F-49JV

PYSEC-2026-2456

Affected Products

Docling-Core

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44019.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2026-2456 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44019 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44019 · Security Note
• https://osv.dev/vulnerability/GHSA-j5xp-7m2f-49jv · Vendor Advisory
• https://github.com/docling-project/docling-core/releases/tag/v2.74.1 · Note
• https://github.com/docling-project/docling-core · Note
• https://github.com/docling-project/docling-core/security/advisories/GHSA-j5xp-7m2f-49jv · Note
• https://twitter.com/dailycve/status/2062368051866030481 · Twitter Post
• https://twitter.com/UpwindMDR/status/2061803157466780042 · Twitter Post
• https://github.com/advisories/GHSA-j5xp-7m2f-49jv · Note
• https://pypi.org/project/docling-core · Note