CVE-2026-44022

Katalog CVE

CVSS 5.5 · Medium EPSS 0,21%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada docling. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \includegraphics, \input, and \include commands lacked path containment validation. Attackers could craft malicious LaTeX documents with path traversal sequences to read arbitrary files from the file system accessible to the process, include sensitive files in the converted document output, or potentially access configuration files, credentials, or other sensitive data This vulnerability is fixed in 2.91.0.

Rincian

Terbit di NVD

24 Juni 2026

Terakhir diubah

26 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/docling-project/docling/security/advisories/GHSA-2j5p-7p5m-cvqr mitigasi · patch · advisory vendor
• https://github.com/docling-project/docling/releases/tag/v2.91.0 product · release notes