{"id":"CVE-2026-47214","aliases":["EUVD-2026-39791","GHSA-q29v-xc37-wh5m","PYSEC-2026-2146"],"status":"published","title":"Docling: Unsafe URI and Path Handling in HTML Backend","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00373,"percentile":0.31719,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-73"],"published":"2026-06-03T21:15:02Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"PyPI","package":"docling","fixed_in":["2.94.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"docling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.94.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"docling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.94.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.3.0","0.3.1","0.4.0","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.10.0","1.11.0","1.12.0","1.12.1","1.12.2","1.13.0","1.13.1","1.14.0","1.15.0","1.16.0","1.16.1","1.17.0","1.18.0","1.19.0","1.19.1","1.2.0","1.2.1","1.20.0","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","2.0.0","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.15.1","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.2.1","2.20.0","2.21.0","2.22.0","2.23.0","2.23.1","2.24.0","2.25.0","2.25.1","2.25.2","2.26.0","2.27.0","2.28.0","2.28.1","2.28.2","2.28.3","2.28.4","2.29.0","2.3.0","2.3.1","2.30.0","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.36.1","2.37.0","2.38.0","2.38.1","2.39.0","2.4.0","2.4.1","2.4.2","2.40.0","2.41.0","2.42.0","2.42.1","2.42.2","2.43.0","2.44.0","2.45.0","2.46.0","2.47.0","2.47.1","2.48.0","2.49.0","2.5.0","2.5.1","2.5.2","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.55.0","2.55.1","2.56.0","2.56.1","2.57.0","2.58.0","2.59.0","2.6.0","2.60.0","2.60.1","2.61.0","2.61.1","2.61.2","2.62.0","2.63.0","2.64.0","2.64.1","2.65.0","2.66.0","2.67.0","2.68.0","2.69.0","2.69.1","2.7.0","2.7.1","2.70.0","2.71.0","2.72.0","2.73.0","2.73.1","2.74.0","2.75.0","2.76.0","2.77.0","2.78.0","2.79.0","2.8.0","2.8.1","2.8.2","2.8.3","2.80.0","2.81.0","2.82.0","2.83.0","2.84.0","2.85.0","2.86.0","2.87.0","2.88.0","2.89.0","2.9.0","2.90.0","2.91.0","2.92.0","2.93.0"]},{"source":"osv","ecosystem":"PyPI","package":"docling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.94.0"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.2.0","0.3.0","0.3.1","0.4.0","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.10.0","1.11.0","1.12.0","1.12.1","1.12.2","1.13.0","1.13.1","1.14.0","1.15.0","1.16.0","1.16.1","1.17.0","1.18.0","1.19.0","1.19.1","1.2.0","1.2.1","1.20.0","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.6.2","1.6.3","1.7.0","1.7.1","1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9.0","2.0.0","2.1.0","2.10.0","2.11.0","2.12.0","2.13.0","2.14.0","2.15.0","2.15.1","2.16.0","2.17.0","2.18.0","2.19.0","2.2.0","2.2.1","2.20.0","2.21.0","2.22.0","2.23.0","2.23.1","2.24.0","2.25.0","2.25.1","2.25.2","2.26.0","2.27.0","2.28.0","2.28.1","2.28.2","2.28.3","2.28.4","2.29.0","2.3.0","2.3.1","2.30.0","2.31.0","2.31.1","2.31.2","2.32.0","2.33.0","2.34.0","2.35.0","2.36.0","2.36.1","2.37.0","2.38.0","2.38.1","2.39.0","2.4.0","2.4.1","2.4.2","2.40.0","2.41.0","2.42.0","2.42.1","2.42.2","2.43.0","2.44.0","2.45.0","2.46.0","2.47.0","2.47.1","2.48.0","2.49.0","2.5.0","2.5.1","2.5.2","2.50.0","2.51.0","2.52.0","2.53.0","2.54.0","2.55.0","2.55.1","2.56.0","2.56.1","2.57.0","2.58.0","2.59.0","2.6.0","2.60.0","2.60.1","2.61.0","2.61.1","2.61.2","2.62.0","2.63.0","2.64.0","2.64.1","2.65.0","2.66.0","2.67.0","2.68.0","2.69.0","2.69.1","2.7.0","2.7.1","2.70.0","2.71.0","2.72.0","2.73.0","2.73.1","2.74.0","2.75.0","2.76.0","2.77.0","2.78.0","2.79.0","2.8.0","2.8.1","2.8.2","2.8.3","2.80.0","2.81.0","2.82.0","2.83.0","2.84.0","2.85.0","2.86.0","2.87.0","2.88.0","2.89.0","2.9.0","2.90.0","2.91.0","2.92.0","2.93.0"]}],"products":[{"vendor":"docling","product":"docling"},{"vendor":"docling-project","product":"docling"}],"references":[{"url":"https://github.com/docling-project/docling/security/advisories/GHSA-q29v-xc37-wh5m","tags":["x_refsource_CONFIRM","Vendor Advisory","Mitigation","Patch","advisory","web","fix"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.94.0","tags":["x_refsource_MISC","Patch","web","fix"]},{"url":"https://github.com/docling-project/docling/releases/tag/v2.91.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47214","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-2146.yaml","tags":["web"]},{"url":"https://github.com/docling-project/docling/pull/3400","tags":["web"]},{"url":"https://github.com/docling-project/docling/pull/3407","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q29v-xc37-wh5m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47214.json","tags":["advisory"]},{"url":"https://github.com/docling-project/docling","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-47214","title":"Docling: Unsafe URI and Path Handling in HTML Backend","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.","status":"published","published":"2026-06-26T15:45:04.659Z","modified":"2026-06-26T18:41:52.977Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-73","CWE-400"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-39791","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.","status":"published","published":"2026-06-26T15:45:04Z","modified":"2026-06-26T18:41:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T18:20:24.118614Z"}],"ghsa":[{"id":"GHSA-q29v-xc37-wh5m","title":"Docling: Unsafe URI and Path Handling in HTML Backend","description":"### Impact\nThe HTML backend did not perform sufficient validation during resource handling:\n- Accepted `file://` URIs enabling local file system access when `enable_local_fetch=True`\n- Path resolution allowed traversal outside intended directories via `../` sequences and absolute paths\n- Did not block internal network resources under `enable_remote_fetch=True`\n- HTTP redirects were not validated, potentially redirecting to unintended schemes\n- No resource limits for remote image downloads and `data:` URIs\n\n### Patches\nFixed in versions 2.91.0 (initial fixes) and 2.94.0 (additional improvements). The fixes implement:\n- Updated local path treatment: absolute files always blocked, relative paths require `enable_local_fetch=True` (default: False) and containment within configured `base_path` for path traversal protection\n- `file://` scheme stripped \u0026 treated as local path (above)\n- IP address validation to prevent SSRF\n- HTTP redirect validation, connection and read timeouts\n- Size limit for both remote images (with streaming download) and base64-decoded data URIs\n\n### Workarounds\nKeep both `enable_local_fetch=False` and `enable_remote_fetch=False` (defaults) when processing untrusted HTML documents.\n\n### References\n- Initial fixes: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)\n- Additional improvements: [v2.94.0](https://github.com/docling-project/docling/releases/tag/v2.94.0)","status":"published","published":"2026-06-03T21:15:02Z","modified":"2026-10-19T19:56:43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-73","CWE-400"],"updated_at":"2026-11-02T14:41:33.669646Z"}],"nvd":[{"id":"CVE-2026-47214","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.","status":"published","published":"2026-06-26T16:16:31.373Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-73","CWE-400"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"CVE-2026-47214","title":"Docling: Unsafe URI and Path Handling in HTML Backend","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.","status":"published","published":"2026-06-26T15:45:04.659Z","modified":"2026-10-28T02:30:43.325975772Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-400","CWE-73"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"GHSA-q29v-xc37-wh5m","title":"Docling: Unsafe URI and Path Handling in HTML Backend","description":"### Impact\nThe HTML backend did not perform sufficient validation during resource handling:\n- Accepted `file://` URIs enabling local file system access when `enable_local_fetch=True`\n- Path resolution allowed traversal outside intended directories via `../` sequences and absolute paths\n- Did not block internal network resources under `enable_remote_fetch=True`\n- HTTP redirects were not validated, potentially redirecting to unintended schemes\n- No resource limits for remote image downloads and `data:` URIs\n\n### Patches\nFixed in versions 2.91.0 (initial fixes) and 2.94.0 (additional improvements). The fixes implement:\n- Updated local path treatment: absolute files always blocked, relative paths require `enable_local_fetch=True` (default: False) and containment within configured `base_path` for path traversal protection\n- `file://` scheme stripped \u0026 treated as local path (above)\n- IP address validation to prevent SSRF\n- HTTP redirect validation, connection and read timeouts\n- Size limit for both remote images (with streaming download) and base64-decoded data URIs\n\n### Workarounds\nKeep both `enable_local_fetch=False` and `enable_remote_fetch=False` (defaults) when processing untrusted HTML documents.\n\n### References\n- Initial fixes: [v2.91.0](https://github.com/docling-project/docling/releases/tag/v2.91.0)\n- Additional improvements: [v2.94.0](https://github.com/docling-project/docling/releases/tag/v2.94.0)","status":"published","published":"2026-06-03T21:15:02Z","modified":"2026-10-19T20:00:04.717120532Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"cwes":["CWE-400","CWE-73"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"PYSEC-2026-2146","description":"Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.","status":"published","published":"2026-06-26T16:16:31.373Z","modified":"2026-07-13T07:15:23.485689409Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}