Docling versions before 2.91.0 contain a path traversal vulnerability (CWE-22) in the EasyOCR model download functionality. This occurs because ZIP archive extraction does not validate member paths, allowing an attacker who compromises the model download source via supply chain attacks, DNS spoofing, or man-in-the-middle attacks to perform Zip Slip attacks. Exploitation could allow arbitrary file writes to any location writable by the process, enabling remote code execution by overwriting Python files or system binaries, persistent backdoors by modifying startup scripts or SSH keys, and data corruption or system compromise. The vulnerability is addressed in docling version 2.91.0. No known exploits are reported in the wild. The CVSS v3.1 base score is 7.5 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring user interaction and high attack complexity.

Successful exploitation allows an attacker to write arbitrary files to any location writable by the docling process, potentially resulting in remote code execution, persistent backdoors, and data corruption or system compromise. This could be achieved by compromising the model download source and leveraging the lack of path validation during ZIP extraction. The impact affects confidentiality, integrity, and availability of the affected system.

A fix is available in docling version 2.91.0. Users should upgrade to version 2.91.0 or later to remediate this vulnerability. Since the vulnerability depends on the ability to compromise the model download source, ensuring the integrity and authenticity of the model source is also recommended. Patch status is confirmed by the vendor advisory. No additional mitigations are specified by the vendor.