CVE-2026-112310
Last modified
CVE-2026-112310 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence..
Description
docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| docling-project | docling-core | <= 2.102.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-112310?
How severe is CVE-2026-112310?
How do I fix CVE-2026-112310?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-112305Semaphore UI through 2.19.16 contains a remote code executio…8.8
- CVE-2026-112306NocoBase @nocobase/plugin-collection-sql through 2.2.28 cont…7.2
- CVE-2026-112307sqlparse through 0.6.0 contains a PHP code injection vulnera…7.3
- CVE-2026-112308crewai-tools through 1.15.28 contains a server-side request …7.4
- CVE-2026-112309@rvf/set-get before 7.0.4 contains a prototype pollution vul…7.5
- CVE-2026-11231Inappropriate implementation in Safe Browsing in Google Chro…8.1
- CVE-2026-11232Inappropriate implementation in TabGroups in Google Chrome p…5.4
- CVE-2026-112328The Sensei LMS WordPress plugin before 4.26.4 contains a bro…4.3
- CVE-2026-112329The Sensei LMS WordPress plugin before 4.26.4 contains a bro…4.3
- CVE-2026-11233Insufficient policy enforcement in FoldableAPIs in Google Ch…4.7
- CVE-2026-11234Inappropriate implementation in FoldableAPIs in Google Chrom…4.3
- CVE-2026-11235Insufficient policy enforcement in Compositing in Google Chr…8.8
Are you affected by CVE-2026-112310?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST