{"id":"CVE-2026-105750","aliases":["EUVD-2026-92814","GHSA-q43m-vhcp-mhvm","PYSEC-2026-4196","PYSEC-2026-4215"],"status":"published","title":"Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00397,"percentile":0.34363,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552","CWE-863"],"published":"2026-10-05T21:38:28Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"PyPI","package":"docling","fixed_in":["2.118.1"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"docling-slim","fixed_in":["2.118.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"docling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.82.0"},{"fixed":"2.118.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"docling-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.92.0"},{"fixed":"2.118.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"docling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.82.0"},{"fixed":"2.118.1"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.82.0","2.83.0","2.84.0","2.85.0","2.86.0","2.87.0","2.88.0","2.89.0","2.90.0","2.91.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"]},{"source":"osv","ecosystem":"PyPI","package":"docling-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.92.0"},{"fixed":"2.118.1"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"]},{"source":"osv","ecosystem":"PyPI","package":"docling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.82.0"},{"fixed":"2.118.1"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.82.0","2.83.0","2.84.0","2.85.0","2.86.0","2.87.0","2.88.0","2.89.0","2.90.0","2.91.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"]},{"source":"osv","ecosystem":"PyPI","package":"docling-slim","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.92.0"},{"fixed":"2.118.1"}]}],"versions":["2.100.0","2.101.0","2.102.0","2.102.1","2.102.2","2.103.0","2.104.0","2.105.0","2.106.0","2.107.0","2.108.0","2.109.0","2.110.0","2.111.0","2.112.0","2.113.0","2.114.0","2.115.0","2.116.0","2.117.0","2.118.0","2.92.0","2.93.0","2.94.0","2.95.0","2.96.0","2.96.1","2.97.0","2.98.0","2.99.0"]}],"products":[{"vendor":"docling","product":"docling"},{"vendor":"docling-project","product":"docling"},{"vendor":"docling-project","product":"docling-slim"}],"references":[{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web","fix"]},{"url":"https://github.com/docling-project/docling/pull/3948","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.118.1","tags":["x_refsource_MISC","Release Notes","web","advisory"]},{"url":"https://github.com/advisories/GHSA-q43m-vhcp-mhvm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105750.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105750","tags":["advisory"]},{"url":"https://github.com/docling-project/docling","tags":["package"]},{"url":"https://pypi.org/project/docling-slim","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-105750","title":"Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.","status":"published","published":"2026-10-05T21:38:28.098Z","modified":"2026-10-06T18:17:27.884Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-552","CWE-863"],"updated_at":"2026-11-02T14:19:56.755658Z"}],"euvd":[{"id":"EUVD-2026-92814","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.","status":"published","published":"2026-10-05T21:38:28Z","modified":"2026-10-06T18:17:27Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-q43m-vhcp-mhvm","title":"Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","description":"### Summary\n\nWhen the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `enable_local_fetch` option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with `\u003ciframe src=\"file:///...\"\u003e`), and that file's contents appear in the page image attached to the returned `DoclingDocument`.\n\n### Details\n\nIn render mode, Playwright requests are filtered by `HTMLDocumentBackend._get_browser_request_block_reason`. In affected versions, this check allowed `file:` URLs unconditionally, before reading any option. As a result:\n\n- `enable_local_fetch=False` did not block local file access, and\n- even with `enable_local_fetch=True`, file access was not limited to the source document's directory, unlike the non-render path (`ImageResourceLoader`), which rejects absolute paths and path traversal.\n\nVersions 2.82.0–2.90.x did no request filtering in render mode at all.\n\nThe browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image.\n\nOnly `Path` inputs are affected. They are loaded through a `file://` URL. Stream inputs are loaded with `page.set_content()` into an opaque origin, from which Chromium does not load `file://` subresources.\n\n### Impact\n\nAn attacker who can submit HTML for conversion can read any text file the conversion process can read (for example `.env` files, credential files, or other users' documents on a shared host) by having it rendered into the page image.\n\nOnly applications that meet **all** of these conditions are affected:\n\n- they set `HTMLBackendOptions(render_page=True)` in Python,\n- they have the optional `playwright` dependency installed, and\n- they pass untrusted HTML as a filesystem `Path`.\n\nThe following are **not** affected: the default configuration (`render_page=False`), the `docling` CLI, `docling-serve`, and the EPUB, Markdown, XBRL and email backends.\n\n### Patches\n\nFixed in **2.118.1** (#3948). In render mode, `file:` requests are now blocked unless `enable_local_fetch=True`, and allowed requests are limited to the source document's directory.\n\n### Workarounds\n\nIf you can't upgrade, don't use `render_page=True` on untrusted HTML, or pass the input as a stream instead of a `Path`.\n\n### Credits\n\nReported by @priyankn.","status":"published","published":"2026-10-06T00:02:27Z","modified":"2026-10-06T00:02:28Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-552","CWE-863"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-105750","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.","status":"published","published":"2026-10-05T22:16:58.097Z","modified":"2026-10-07T17:52:51.153Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-552","CWE-863"],"updated_at":"2026-11-02T14:12:54.129949Z"}],"osv":[{"id":"CVE-2026-105750","title":"Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.","status":"published","published":"2026-10-05T21:38:28.098Z","modified":"2026-10-28T02:30:54.52258425Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-552","CWE-863"],"updated_at":"2026-11-02T15:44:54.583213Z"},{"id":"GHSA-q43m-vhcp-mhvm","title":"Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","description":"### Summary\n\nWhen the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `enable_local_fetch` option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with `\u003ciframe src=\"file:///...\"\u003e`), and that file's contents appear in the page image attached to the returned `DoclingDocument`.\n\n### Details\n\nIn render mode, Playwright requests are filtered by `HTMLDocumentBackend._get_browser_request_block_reason`. In affected versions, this check allowed `file:` URLs unconditionally, before reading any option. As a result:\n\n- `enable_local_fetch=False` did not block local file access, and\n- even with `enable_local_fetch=True`, file access was not limited to the source document's directory, unlike the non-render path (`ImageResourceLoader`), which rejects absolute paths and path traversal.\n\nVersions 2.82.0–2.90.x did no request filtering in render mode at all.\n\nThe browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image.\n\nOnly `Path` inputs are affected. They are loaded through a `file://` URL. Stream inputs are loaded with `page.set_content()` into an opaque origin, from which Chromium does not load `file://` subresources.\n\n### Impact\n\nAn attacker who can submit HTML for conversion can read any text file the conversion process can read (for example `.env` files, credential files, or other users' documents on a shared host) by having it rendered into the page image.\n\nOnly applications that meet **all** of these conditions are affected:\n\n- they set `HTMLBackendOptions(render_page=True)` in Python,\n- they have the optional `playwright` dependency installed, and\n- they pass untrusted HTML as a filesystem `Path`.\n\nThe following are **not** affected: the default configuration (`render_page=False`), the `docling` CLI, `docling-serve`, and the EPUB, Markdown, XBRL and email backends.\n\n### Patches\n\nFixed in **2.118.1** (#3948). In render mode, `file:` requests are now blocked unless `enable_local_fetch=True`, and allowed requests are limited to the source document's directory.\n\n### Workarounds\n\nIf you can't upgrade, don't use `render_page=True` on untrusted HTML, or pass the input as a stream instead of a `Path`.\n\n### Credits\n\nReported by @priyankn.","status":"published","published":"2026-10-06T00:02:27Z","modified":"2026-10-15T14:56:09.321370624Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-552","CWE-863"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"PYSEC-2026-4196","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.","status":"published","published":"2026-10-05T22:16:58.097Z","modified":"2026-10-15T14:56:09.321370624Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"PYSEC-2026-4215","title":"Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode","description":"### Summary\n\nWhen the HTML backend renders pages in a headless browser (`HTMLBackendOptions(render_page=True)`), the `enable_local_fetch` option is not enforced. A crafted HTML file can embed an arbitrary local file (for example with `\u003ciframe src=\"file:///...\"\u003e`), and that file's contents appear in the page image attached to the returned `DoclingDocument`.\n\n### Details\n\nIn render mode, Playwright requests are filtered by `HTMLDocumentBackend._get_browser_request_block_reason`. In affected versions, this check allowed `file:` URLs unconditionally, before reading any option. As a result:\n\n- `enable_local_fetch=False` did not block local file access, and\n- even with `enable_local_fetch=True`, file access was not limited to the source document's directory, unlike the non-render path (`ImageResourceLoader`), which rejects absolute paths and path traversal.\n\nVersions 2.82.0–2.90.x did no request filtering in render mode at all.\n\nThe browser runs with JavaScript disabled (from 2.91.0), so disclosure is passive: only what Chromium renders visibly inside the page viewport ends up in the page image.\n\nOnly `Path` inputs are affected. They are loaded through a `file://` URL. Stream inputs are loaded with `page.set_content()` into an opaque origin, from which Chromium does not load `file://` subresources.\n\n### Impact\n\nAn attacker who can submit HTML for conversion can read any text file the conversion process can read (for example `.env` files, credential files, or other users' documents on a shared host) by having it rendered into the page image.\n\nOnly applications that meet **all** of these conditions are affected:\n\n- they set `HTMLBackendOptions(render_page=True)` in Python,\n- they have the optional `playwright` dependency installed, and\n- they pass untrusted HTML as a filesystem `Path`.\n\nThe following are **not** affected: the default configuration (`render_page=False`), the `docling` CLI, `docling-serve`, and the EPUB, Markdown, XBRL and email backends.\n\n### Patches\n\nFixed in **2.118.1** (#3948). In render mode, `file:` requests are now blocked unless `enable_local_fetch=True`, and allowed requests are limited to the source document's directory.\n\n### Workarounds\n\nIf you can't upgrade, don't use `render_page=True` on untrusted HTML, or pass the input as a stream instead of a `Path`.\n\n### Credits\n\nReported by @priyankn.","status":"published","published":"2026-10-15T10:22:46.471738Z","modified":"2026-10-15T14:56:09.321370624Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"}]}}