CVE-2026-105750

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTMLDocumentBackend._get_browser_request_block_reason does not enforce the enable_local_fetch setting or confine local requests to the source document directory. Crafted path-backed HTML can embed a readable local text file in a browser-rendered page image when Playwright is installed. Only filesystem Path inputs are affected because stream inputs use an opaque origin, and the default configuration, command-line interface, docling-serve, and non-rendering backends are not affected. This issue is fixed in 2.118.1.

• CWE-552
• CWE-863

• https://github.com/docling-project/docling/commit/1612b8875b0937447ce3122536fb5360a7102a0a
• https://github.com/docling-project/docling/pull/3948
• https://github.com/docling-project/docling/releases/tag/v2.118.1
• https://github.com/docling-project/docling/security/advisories/GHSA-q43m-vhcp-mhvm

Published

Oct 5, 2026

Last Modified

Oct 6, 2026

Status

Undergoing Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105745Docling simplifies document processing by parsing diverse fo…6.7
• CVE-2026-105746Docling simplifies document processing by parsing diverse fo…2.2
• CVE-2026-105747Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105748Docling simplifies document processing by parsing diverse fo…4.3
• CVE-2026-105749Docling simplifies document processing by parsing diverse fo…6.5
• CVE-2026-10575IBM MQ could allow an authenticated attacker to cause a deni…8.8
• CVE-2026-105751Docling simplifies document processing by parsing diverse fo…6.9
• CVE-2026-105752vLLM is an inference and serving engine for large language m…3.1
• CVE-2026-105753vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-105754vLLM is an inference and serving engine for large language m…6.5
• CVE-2026-105755vLLM is an inference and serving engine for large language m…4.2
• CVE-2026-105756vLLM is an inference and serving engine for large language m…6.5