CVE-2026-105751: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in docling-project docling

Docling's backend component for OpenDocument processing (docling/backend/opendocument_backend.py) improperly handles the xlink:href attribute of draw:image elements by using it as a filesystem path without validating the scheme, enforcing extraction-directory confinement, or applying the enable_local_fetch setting used elsewhere. This allows an attacker to perform path traversal to read arbitrary files on the filesystem that Pillow can decode as images, potentially embedding these files in the converted output and revealing the presence of files through read attempts. The vulnerability affects versions >=2.107.0 and <2.120.3 and is resolved in 2.120.3.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the filesystem that are interpretable as images by Pillow. This can lead to information disclosure by embedding unintended image files in document outputs and distinguishing existing paths through read attempts. There is no indication of code execution or privilege escalation. The CVSS 4.0 score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality.

This vulnerability is fixed in docling version 2.120.3. Users should upgrade to version 2.120.3 or later to remediate this issue. No other mitigations are indicated by the vendor advisory or source data.