CVE-2026-105748: Local File Inclusion and Arbitrary File Disclosure in Docling Document Parser

The Docling document conversion library offers capabilities for parsing, structured layout extraction, and format conversions. It supports a declarative input schema via serialized JSON models, identified as the InputFormat.JSON_DOCLING backend. Within this input flow, the parser processes metadata structures including image definitions to rebuild or render document elements.

Historically, the parser accepted remote or local source references within its image schema without restricting the target protocols. This lack of restriction allows untrusted serialized JSON payloads to specify local file paths. Because the system subsequently attempts to access and embed these image references during export, it exposes the host system to Local File Inclusion (LFI).

An attacker can exploit this behavior by passing a crafted JSON document containing arbitrary local system file paths. The impact spans beyond file reading, allowing path validation, file existence mapping, and, under specific conditions, full exfiltration of sensitive graphical or binary files. The vulnerability exposes any deployment where Docling processes untrusted documents on a server-side backend.

The root cause lies in how Docling resolves asset URI schemes during its export pipeline. When a client imports a document using InputFormat.JSON_DOCLING, the backend deserializes the payload into Pydantic models. Within this model hierarchy, ImageRef objects represent individual images and store their locations in a uri property.

When exporting the parsed document using an embedded image mode (such as ImageRefMode.EMBEDDED), the engine calls internal resolution routines. Specifically, the method DoclingDocument._with_embedded_pictures delegates to ImageRef.pil_image to fetch the source asset. Because the uri property lacked validation filters, it can point directly to local filesystem paths.

The library resolves the path and invokes the Pillow (PIL) library's Image.open method. If the file is a valid image, Pillow reads its binary contents, which are subsequently Base64-encoded and outputted. If the path exists but fails image validation, or does not exist, the server throws specific exceptions. An attacker can analyze these error variations to discover file existence and directories.

The vulnerability was addressed by introducing input sanitization filters within the JSON ingestion backend. In vulnerable versions, deserialization parsed the model directly and preserved local file paths in the ImageRef.uri fields without verification.

The remediation patch introduces the function _clear_local_image_refs inside docling/backend/json/docling_json_backend.py. This helper recurses down the entire Pydantic object hierarchy to find ImageRef instances. If the schema validator detects an asset URI that does not conform to a whitelisted secure remote scheme, the URI is wiped and set to None.

_KEPT_IMAGE_URI_SCHEMES = frozenset({"data", "http", "https"})
 
def _is_kept_image_uri(uri: AnyUrl | Path) -> bool:
    # Restrict URIs to whitelisted web protocols
    return isinstance(uri, AnyUrl) and uri.scheme.lower() in _KEPT_IMAGE_URI_SCHEMES
 
def _clear_local_image_refs(node: object) -> int:
    cleared = 0
    if isinstance(node, BaseModel):
        for name, value in node:
            if isinstance(value, ImageRef):
                if not _is_kept_image_uri(value.uri):
                    # Strips local files or unapproved schemes by replacing with None
                    setattr(node, name, None)
                    cleared += 1
            else:
                cleared += _clear_local_image_refs(value)
    # Tree-walking continues for list, tuple, and dict structures
    return cleared

This defensive filter blocks local paths from propagating into the core export engines. By applying this logic during initial JSON loading, downstream processes cannot trigger local image rendering.

Exploitation requires that an application ingest an attacker-controlled JSON file and export it using embedded graphics. Because the attack utilizes standard parser functions, the adversary needs no privileges on the target environment.

An attacker constructs a payload targeting local configurations, keys, or screenshots stored as images on the host filesystem. An example target path is /opt/app/sensitive_system_graphic.png or directories containing readable administrative assets.

{
  "schema_name": "DoclingDocument",
  "version": "1.0.0",
  "name": "Exploit payload",
  "pictures": [
    {
      "image": {
        "mimetype": "image/png",
        "dpi": 72,
        "size": {"width": 100, "height": 100},
        "uri": "/opt/app/sensitive_system_graphic.png"
      }
    }
  ]
}

When the converter processes this file and converts it into markdown with embedded objects, it writes out the Base64 representation of the file. The attacker receives this serialized output, decodes it, and recovers the target image. If non-image files are targeted, the application might return diagnostic error logs that reveal the presence or absence of the files, exposing a secondary path existence verification vulnerability.

A major residual risk exists for applications interacting directly with low-level components. The remediation code resides inside the docling high-level backend parser package, rather than the core schema definitions of docling-core.

If a developer ingests JSON directly using DoclingDocument.model_validate_json or similar schema-level methods in docling-core, the input sanitization filters are completely bypassed. Because the core library is unpatched, downstream pipelines operating directly on the schema remain vulnerable to the same local file exposure vector.

Additionally, the default protocol whitelist permits http and https schemas. This configuration exposes the server to Server-Side Request Forgery (SSRF) threats. An attacker can reference internal addresses or metadata endpoints, causing the host server to fetch local sensitive details or probe internal networks.

http://169.254.169.254/latest/meta-data/

Lastly, parser inconsistencies between Pydantic's AnyUrl parsing and the operating system's file resolver could lead to bypasses. For instance, Windows UNC paths or local administrative paths might elude the standard scheme filters but still trigger file access when handled by Python's underlying file APIs.