CVE-2026-47214CWE-400CWE-73

Docling: Unsafe URI and Path Handling in HTML Backend

High · published June 26, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
30.1
In the wild
Unconfirmed
What it is

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. Prior to 2.94.0, the HTML backend has unsafe URI and path handling. This vulnerability is fixed in 2.94.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00373 · 30.1th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-73 · External Control of File Name or Path
Published
2026-06-26T15:45Z
EPSS history
Timeline
  • 26 JUN 15:45Z
    Docling: Unsafe URI and Path Handling in HTML Backend
    cvelistv5