GitHub Advisoryadvisory · PyPI

GHSA-jmmv-h3mp-59v8 Docling Core: Unsafe remote filename resolution

HIGH Published 2026-06-03 Modified 2026-06-03 Official page ↗
Aliases
CVE-2026-44023
Ecosystem
PyPI
Packages
docling-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-22, CWE-918
Reviewed
2026-06-03

Affected packages

• PyPI docling-core: >= 1.5.0, < 2.74.1 → fixed in 2.74.1

Description

Impact In versions `>= 1.5.0, = 2.74.1` Workarounds If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality. References • Fix release: `v2.74.1`

Related

Alias · CVE (1)

  • CVE-2026-44023 Docling Core defines core data types and transformations for the document processing application Docling. vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-918 Server-Side Request Forgery weakness

References