PT-2026-46122 · Docling · Docling

CVE-2026-44022 · Published 2026-06-03 · Updated 2026-06-26

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Docling versions prior to 2.91.0

Description The LaTeX backend fails to validate path containment when handling the includegraphics, input, and include commands. This allows attackers to use path traversal sequences, such as ../../../etc/passwd, to read arbitrary files from the file system accessible to the process and include sensitive data, such as configuration files or credentials, in the converted document output.

Recommendations Update to version 2.91.0. Avoid processing untrusted LaTeX documents. Run the process in a sandboxed environment with restricted file system access.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-44022

GHSA-2J5P-7P5M-CVQR

PYSEC-2026-2145

Affected Products

Docling

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44022.json · Exploit
• https://github.com/docling-project/docling/security/advisories/GHSA-2j5p-7p5m-cvqr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2j5p-7p5m-cvqr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2145 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-44022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44022 · Security Note
• https://github.com/docling-project/docling · Note
• https://github.com/docling-project/docling/releases/tag/v2.91.0 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2145.yaml · Note
• https://t.me/cveNotify/175668 · Telegram Post
• https://twitter.com/dailycve/status/2062377097503375462 · Twitter Post
• https://t.me/cveNotify/174395 · Telegram Post
• https://t.me/cveNotify/177633 · Telegram Post