PT-2026-46123 · Pypi · Docling-Core

Published 2026-06-03 · Updated 2026-06-04 · CVE-2026-44023

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions docling-core versions 1.5.0 through 2.74.0

Description The software does not sufficiently restrict remote request destinations and can resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this can lead to Server-Side Request Forgery (SSRF), which is a technique where an attacker forces a server to make requests to an unintended location, targeting local files outside the user-defined cache directory.

Recommendations Update to version 2.74.1 or later. As a temporary workaround, avoid passing untrusted URLs into remote fetch functionality.

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

Related Identifiers

CVE-2026-44023

GHSA-JMMV-H3MP-59V8

Affected Products

Docling-Core

References · 5

• https://osv.dev/vulnerability/GHSA-jmmv-h3mp-59v8 · Vendor Advisory
• https://github.com/docling-project/docling-core/releases/tag/v2.74.1 · Note
• https://github.com/docling-project/docling-core · Note
• https://github.com/docling-project/docling-core/security/advisories/GHSA-jmmv-h3mp-59v8 · Note
• https://twitter.com/dailycve/status/2062373556848091161 · Twitter Post