### Impact
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
### Patches
Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to `>= 3.88.0` or `>= 4.0.0-canary.27`.
### Workarounds
Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.
### Summary
docling accepts serialized `DoclingDocument` JSON as an input format (`InputFormat.JSON_DOCLING`, enabled by default). A crafted JSON file can set a picture's image `uri` to a local file path. When the converted document is exported with embedded images (`ImageRefMode.EMBEDDED`, the CLI default for Markdown and HTML), the referenced file is read and embedded as base64 in the output.
### Details
`docling/backend/json/docling_json_backend.py` validates the JSON into a `DoclingDocument` without checking image references. The file is then read by docling-core:
- `DoclingDocument._with_embedded_pictures` opens `file://` and plain-path URIs with PIL.
- `ImageRef.pil_image` checks `allow_image_file_uri` for `file://` URIs but not for plain `Path` values. docling's picture enrichment models load images through this property.
Only files that PIL can decode as an image are disclosed. Other files, such as text files or keys, fail to decode and are not embedded. The different error behaviour does reveal whether a path exists.
### Impact
Disclosure of image files readable by the converting process (for example other users' uploads or page images in a shared service), and disclosure of whether a local path exists.
### Proof of concept
```python
from pathlib import Path
from docling_core.types.doc import DoclingDocument, ImageRef
from docling_core.types.doc.base import Size
doc = DoclingDocument(name="poc")
doc.add_picture(image=ImageRef(mimetype="image/png", dpi=72, size=Size(width=1, height=1),
uri=Path("/srv/uploads/other-user/scan.png")))
doc.save_as_json("poc.json")
```
`docling poc.json --to md` embeds the referenced PNG as base64 in `poc.md`.
### Patches
Fixed in docling 2.131.0 by [#4417](https://github.com/docling-project/docling/pull/4417). The Docling JSON backend now drops image references that point at local files (paths, `file:` URIs and any scheme other than `data:` and `http(s)`) and logs a warning. Callers that need to load local images from JSON they trust can opt in with `DoclingJSONFormatOption(backend_options=DeclarativeBackendOptions(enable_local_fetch=True))`; the CLI has no such option.
Code that loads untrusted JSON directly with docling-core (`DoclingDocument.load_from_json`) and exports it with embedded images is not covered by this fix; that part is tracked in docling-core.
### Workarounds
Upgrade to 2.131.0. For older versions:
- Remove `InputFormat.JSON_DOCLING` from `allowed_formats` when converting untrusted input.
- Export with `ImageRefMode.PLACEHOLDER` or `ImageRefMode.REFERENCED` instead of `EMBEDDED`.
Plane, an open-source project management tool, has a critical vulnerability (CVE-2026-105639) affecting versions prior to 1.4.0. The signup flow creates a logged-in user record for any submitted email without verifying ownership. This allows an unauthenticated attacker to register with a victim's email, enumerate pending workspace invitations, and accept them, gaining unauthorized access with the invited role. The issue is fixed in version 1.4.0.
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, token, and role, to unauthenticated callers. The corresponding POST endpoint checks only whether the submitted email matches project_invite.email and does not validate the invitation token. An attacker who knows the invitation UUID can discover the invited email, register an account with that email, and accept the invitation without receiving the original invite. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, had a vulnerability prior to version 1.4.0 where certain API endpoints exposed sensitive information from private projects to any authenticated workspace member. Specifically, the GET /api/workspaces/{slug}/cycles/ and GET /api/workspaces/{slug}/modules/ endpoints returned data without verifying project membership, allowing unauthorized enumeration of project details. This issue was fixed in version 1.4.0.
CVE-2026-63270 is a vulnerability in LibreOffice version 26.2 where URLs constructed from environment variables or INI file values could lead to exposure of sensitive information. This occurs because certain document elements (XForms instance data and Calc csv and sql data providers) still allowed expansion of internal schemes in URLs, enabling potential exfiltration of sensitive data to remote servers. The issue was addressed by refusing URLs with internal schemes from documents in fixed versions.
CVE-2026-63269 is a server-side request forgery (SSRF) vulnerability in LibreOffice version 26.2. The issue arises when LibreOffice links to audio and video files, specifically on Linux where it uses GStreamer to play media. An attacker could craft an HLS playlist that causes GStreamer to read local and remote files listed in the playlist during document loading, potentially exposing their contents. The vulnerability has been addressed in fixed versions by preventing LibreOffice from following playlists that reference further resources and by placing linked media under link update control.
CVE-2026-63267 is a server-side request forgery (SSRF) vulnerability in LibreOffice Calc version 26.2. It allows a document to link a cell range to an external CSV data source, which is fetched when the document loads. This behavior could enable reading local files into the spreadsheet or making requests to arbitrary hosts chosen by the document. The vulnerability is addressed in fixed versions where external data links are updated under the same control as other spreadsheet links.
LibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder of local text files as a database, so opening a document could read a local text file into the sheet. In fixed versions only the csv, html and xml data providers are restored when a document is loaded.
CVE-2026-86817 is an information exposure vulnerability in the Five Star Business Profile and Schema WordPress plugin versions 2.3.20 up to but not including 2.4.0. Authenticated users with Author-level access or higher can exploit improper callback restrictions to disclose sensitive data such as other users' password hashes and arbitrary site option values. This sensitive information can be exposed in publicly accessible output, making it readable by unauthenticated visitors. The vulnerability has a medium severity with a CVSS score of 4.9.
CVE-2026-71883 is a vulnerability in Legion of the Bouncy Castle Inc.'s BC-LTS-JAVA library versions from 2.73.4 up to but not including 2.73.13. The issue involves native packet ciphers for AES modes where the JNI ReleaseByteArrayElements function was called in a way that could cause the caller's cryptographic key to overwrite ciphertext when encrypting in place. This leads to exposure of the raw AES key instead of the expected ciphertext, potentially leaking sensitive key material. The flaw was fixed in version 2.73.13 by changing the release mode to JNI_ABORT for read-only input arrays, preventing the native copy from being committed back to the Java array.
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code.
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
WP Ultimate CSV Importer versions before 9.2 expose personal user data imported from CSV files due to improper protection of import log files. The plugin does not use a site-specific secret to secure the storage location of these logs under the uploads directory, nor does it restrict direct access to them. This allows unauthenticated attackers to retrieve sensitive information.
The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.3 via the 'x-yamidoo-signature (attacker-obtained via inline_js identify payload)' parameter. This makes it possible for unauthenticated attackers to extract the full customer card — including name, WordPress user ID, order history, order totals, purchased products, payment method labels, and EDD Software Licensing license keys with status and activation counts — for any arbitrary victim email address on the site. Exploitation requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email address whose local part encodes the target timestamp and victim email, allowing the signature printed into the page HTML by inline_js() to pass verify_request() for an arbitrary victim; both the share_customer_data and identify_logged_in settings are enabled by default, so no non-default configuration is required.