CVE-2026-44022 is a path traversal vulnerability (CWE-22) in the docling LaTeX backend affecting versions >=2.73.0 and <2.91.0. The issue arises because the handling of \includegraphics, \input, and \include commands lacked proper path containment validation, enabling attackers to craft malicious LaTeX documents that traverse directories and access arbitrary files on the file system accessible to the docling process. This could lead to unauthorized disclosure of sensitive files or configuration data. The vulnerability has a CVSS v3.1 base score of 5.5 (medium severity) with local attack vector, low complexity, no privileges required, user interaction required, and high confidentiality impact. The issue is fixed in version 2.91.0.

Successful exploitation allows an attacker to read arbitrary files on the file system accessible to the docling process by leveraging path traversal sequences in LaTeX commands. This can lead to unauthorized disclosure of sensitive information such as configuration files, credentials, or other protected data. There is no indication of integrity or availability impact.

Upgrade docling to version 2.91.0 or later, where this path traversal vulnerability is fixed. No other mitigation or workaround is indicated. Patch status is not explicitly stated in vendor advisories, but the fix is included in version 2.91.0.