{"id":"CVE-2026-44023","aliases":["EUVD-2026-45043","GHSA-jmmv-h3mp-59v8","PYSEC-2026-2457"],"status":"published","title":"Docling Core has unsafe remote filename resolution","description":"Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00427,"percentile":0.37291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-918"],"published":"2026-06-03T21:16:25Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"PyPI","package":"docling-core","fixed_in":["2.74.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"docling-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"2.74.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"docling-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"2.74.1"}]}],"versions":["1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.7.2","2.0.0","2.0.1","2.1.0","2.10.0","2.11.0","2.12.0","2.12.1","2.13.0","2.13.1","2.14.0","2.15.0","2.15.1","2.16.0","2.16.1","2.17.0","2.17.1","2.17.2","2.18.0","2.18.1","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.1","2.21.2","2.22.0","2.23.0","2.23.1","2.23.2","2.23.3","2.24.0","2.24.1","2.25.0","2.26.0","2.26.1","2.26.2","2.26.3","2.26.4","2.27.0","2.28.0","2.28.1","2.29.0","2.3.0","2.3.1","2.3.2","2.30.0","2.30.1","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.33.1","2.34.0","2.34.1","2.34.2","2.35.0","2.36.0","2.37.0","2.38.0","2.38.1","2.38.2","2.39.0","2.4.0","2.4.1","2.40.0","2.41.0","2.42.0","2.43.0","2.43.1","2.44.0","2.44.1","2.44.2","2.45.0","2.46.0","2.47.0","2.48.0","2.48.1","2.48.2","2.48.3","2.48.4","2.49.0","2.5.0","2.5.1","2.50.0","2.50.1","2.51.0","2.51.1","2.52.0","2.53.0","2.54.0","2.54.1","2.55.0","2.56.0","2.57.0","2.58.0","2.58.1","2.59.0","2.6.0","2.6.1","2.60.0","2.60.1","2.60.2","2.61.0","2.62.0","2.63.0","2.64.0","2.65.0","2.65.1","2.65.2","2.66.0","2.67.0","2.67.1","2.68.0","2.69.0","2.7.0","2.7.1","2.70.0","2.70.1","2.70.2","2.71.0","2.72.0","2.73.0","2.74.0","2.8.0","2.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"docling-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"2.74.1"}]}],"versions":["1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.7.2","2.0.0","2.0.1","2.1.0","2.10.0","2.11.0","2.12.0","2.12.1","2.13.0","2.13.1","2.14.0","2.15.0","2.15.1","2.16.0","2.16.1","2.17.0","2.17.1","2.17.2","2.18.0","2.18.1","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.2.3","2.20.0","2.21.0","2.21.1","2.21.2","2.22.0","2.23.0","2.23.1","2.23.2","2.23.3","2.24.0","2.24.1","2.25.0","2.26.0","2.26.1","2.26.2","2.26.3","2.26.4","2.27.0","2.28.0","2.28.1","2.29.0","2.3.0","2.3.1","2.3.2","2.30.0","2.30.1","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.33.1","2.34.0","2.34.1","2.34.2","2.35.0","2.36.0","2.37.0","2.38.0","2.38.1","2.38.2","2.39.0","2.4.0","2.4.1","2.40.0","2.41.0","2.42.0","2.43.0","2.43.1","2.44.0","2.44.1","2.44.2","2.45.0","2.46.0","2.47.0","2.48.0","2.48.1","2.48.2","2.48.3","2.48.4","2.49.0","2.5.0","2.5.1","2.50.0","2.50.1","2.51.0","2.51.1","2.52.0","2.53.0","2.54.0","2.54.1","2.55.0","2.56.0","2.57.0","2.58.0","2.58.1","2.59.0","2.6.0","2.6.1","2.60.0","2.60.1","2.60.2","2.61.0","2.62.0","2.63.0","2.64.0","2.65.0","2.65.1","2.65.2","2.66.0","2.67.0","2.67.1","2.68.0","2.69.0","2.7.0","2.7.1","2.70.0","2.70.1","2.70.2","2.71.0","2.72.0","2.73.0","2.74.0","2.8.0","2.9.0"]}],"products":[{"vendor":"docling","product":"docling-core"},{"vendor":"docling-project","product":"docling-core"}],"references":[{"url":"https://github.com/docling-project/docling-core/security/advisories/GHSA-jmmv-h3mp-59v8","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/docling-project/docling-core/releases/tag/v2.74.1","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-jmmv-h3mp-59v8","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44023.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44023","tags":["advisory"]},{"url":"https://github.com/docling-project/docling-core","tags":["package"]},{"url":"https://pypi.org/project/docling-core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44023","title":"Docling Core has unsafe remote filename resolution","description":"Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.","status":"published","published":"2026-07-16T21:00:49.617Z","modified":"2026-07-17T18:06:33.532Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-918"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-45043","description":"Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.","status":"published","published":"2026-07-16T21:00:49Z","modified":"2026-07-17T18:06:33Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T18:19:50.451546Z"}],"ghsa":[{"id":"GHSA-jmmv-h3mp-59v8","title":"Docling Core: Unsafe remote filename resolution","description":"### Impact\nIn versions `\u003e= 1.5.0, \u003c 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.\n\nIn applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.\n\n### Patches\nPatched in `docling-core` `2.74.1`.\nThe fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.\n\nUsers should upgrade to:\n- `docling-core` `\u003e= 2.74.1`\n\n### Workarounds\nIf upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.\n\n### References\n- Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)","status":"published","published":"2026-06-03T21:16:25Z","modified":"2026-06-03T21:16:26Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22","CWE-918"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-44023","description":"Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.","status":"published","published":"2026-07-16T21:17:21.123Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-918"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-44023","title":"Docling Core has unsafe remote filename resolution","description":"Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.","status":"published","published":"2026-07-16T21:00:49.617Z","modified":"2026-10-28T02:30:24.145842413Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22","CWE-918"],"updated_at":"2026-11-02T15:45:04.820169Z"},{"id":"GHSA-jmmv-h3mp-59v8","title":"Docling Core: Unsafe remote filename resolution","description":"### Impact\nIn versions `\u003e= 1.5.0, \u003c 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.\n\nIn applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.\n\n### Patches\nPatched in `docling-core` `2.74.1`.\nThe fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.\n\nUsers should upgrade to:\n- `docling-core` `\u003e= 2.74.1`\n\n### Workarounds\nIf upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.\n\n### References\n- Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)","status":"published","published":"2026-06-03T21:16:25Z","modified":"2026-07-13T16:43:42.701865915Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-22","CWE-918"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"PYSEC-2026-2457","title":"Docling Core: Unsafe remote filename resolution","description":"### Impact\nIn versions `\u003e= 1.5.0, \u003c 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.\n\nIn applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.\n\n### Patches\nPatched in `docling-core` `2.74.1`.\nThe fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.\n\nUsers should upgrade to:\n- `docling-core` `\u003e= 2.74.1`\n\n### Workarounds\nIf upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.\n\n### References\n- Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)","status":"published","published":"2026-07-13T15:46:14.570481Z","modified":"2026-07-13T16:31:40.059243896Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}