8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44019

CVE-2026-44019: Docling Core: Insufficient validation of image reference URIs

Impact

In versions >= 2.5.0, < 2.74.1, docling-core could allow local file:// image references and accepted inline data: content without a decoded-size limit.

In applications that accept untrusted image references, this may allow access to local files readable by the process or excessive memory use from large inline payloads.

Patches

Patched in docling-core 2.74.1. The fix blocks local file URIs by default and adds a size limit for decoded inline image data.

Users should upgrade to:

docling-core >= 2.74.1

Workarounds

If upgrading is not immediately possible:

reject file: and data: image references from untrusted input
allow only approved local or remote image sources
apply input size and memory limits to processing workers

References

Fix release: v2.74.1

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44019

CVE-2026-44019:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
docling-core	pip	>= 2.5.0, < 2.74.1	2.74.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in GHSA-j5xp-7m2f-49jv lies in the insufficient validation of image reference URIs in the docling-core library. The advisory points to two specific issues: the allowance of local file:// URIs and the lack of a size limit for inline data: URI content. By analyzing the commits between the last vulnerable version (2.74.0) and the patched version (2.74.1), I identified the fixing commit 2087d0f362619be71df50ad4bf3d0a975e15108b. The changes in this commit are concentrated in the pil_image property of the ImageRef class within docling_core/types/doc/document.py. The patch explicitly adds checks to block file:// URIs by default and to validate the size of decoded data: URI payloads against a configurable limit. The vulnerable function is therefore ImageRef.pil_image, as it is the function responsible for processing the malicious URI and loading the image data, either from a local file path or an inline data string.

Vulnerable functions

ImageRef.pil_image

docling_core/types/doc/document.py

The `pil_image` property of the `ImageRef` class was vulnerable. Before the patch, it would process `file://` URIs without restriction, allowing access to any local file readable by the process. It also handled `data:` URIs by decoding base64 content without any size validation, which could lead to excessive memory consumption (Denial of Service) if a large payload was provided. An attacker could exploit this by crafting an image reference pointing to a local file or a very large inline data payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.