CVE-2026-44018CWE-409CWE-611CWE-776
Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Medium · published June 26, 2026
What it is
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.
The record
Technical detail
- CVSS v3.1
- 5.5 · MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00161 · 4.9th percentile
- Weaknesses
- CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification); CWE-611 · Improper Restriction of XML External Entity Reference; CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
- Published
- 2026-06-26T15:40Z
EPSS history
Timeline