8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44023

CVE-2026-44023: Docling Core: Unsafe remote filename resolution

Impact

In versions >= 1.5.0, < 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner.

In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.

Patches

Patched in docling-core 2.74.1. The fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.

Users should upgrade to:

docling-core >= 2.74.1

Workarounds

If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.

References

Fix release: v2.74.1

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44023

CVE-2026-44023:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
docling-core	pip	>= 1.5.0, < 2.74.1	2.74.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in docling-core is a combination of Server-Side Request Forgery (SSRF) and Path Traversal. The analysis of the security patch v2.74.1 reveals that the root cause lies in two functions within docling_core/utils/file.py.

The first vulnerable function, resolve_source_to_stream, was responsible for fetching content from a given URL. It failed to validate whether the URL pointed to a legitimate public resource or an internal, private one. This allowed an attacker to force the application to make requests to internal services (SSRF). The patch mitigates this by introducing _is_safe_url, a function that checks if the URL's resolved IP address is public, and applies this check to both the initial URL and any subsequent redirects.

The second vulnerable function, resolve_remote_filename, was responsible for determining the local filename for the downloaded content. It extracted the filename from the Content-Disposition header or the URL path without proper sanitization. This created a path traversal vulnerability, where an attacker could craft a malicious filename (e.g., ../../etc/passwd) to write files outside of the intended destination directory. The patch addresses this by using a new _sanitize_filename function to strip any directory information from the filename, ensuring only a safe basename is used.

Additionally, a related hardening fix was identified in docling_core/types/doc/document.py within the ImageRef.pil_image method. This change restricts the use of file:// URIs for loading images by default, further reducing the attack surface for local file inclusion vulnerabilities.

Vulnerable functions

resolve_source_to_stream

docling_core/utils/file.py

This function was vulnerable to Server-Side Request Forgery (SSRF) because it fetched content from a user-provided URL without validating if the URL pointed to an internal or restricted resource. The patch introduced a check (`_is_safe_url`) to ensure the URL points to a public, globally routable address, and also validates any redirects.

resolve_remote_filename

docling_core/utils/file.py

This function was vulnerable to path traversal. It extracted the filename from the `Content-Disposition` header or the URL path but did not sanitize it. An attacker could provide a filename like `../../../../etc/passwd` to write files outside the intended directory. The patch introduced `_sanitize_filename` to strip path information and return only a safe basename.

ImageRef.pil_image

docling_core/types/doc/document.py

This method loads an image from a URI. The vulnerable version would open `file://` URIs without restriction, allowing potential access to local files if an attacker could control the URI passed to this method. The patch introduced a configurable setting (`allow_image_file_uri`), disabled by default, to prevent loading images from local file paths.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.