CVE-2026-105748 | docling-project docling/docling-slim up to 2.130.x InputFormat.JSON_DOCLING backend docling_json_backend.py information disclosure

October 5, 2026 Yanac

A vulnerability described as problematic has been identified in docling-project docling and docling-slim up to 2.130.x. The impacted element is the function DoclingDocument._with_embedded_pictures/ImageRef.pil_image of the file docling/backend/json/docling_json_backend.py of the component InputFormat.JSON_DOCLING backend. The manipulation results in information disclosure.

This vulnerability was named CVE-2026-105748. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More