CVE-2026-44022

{
  "id": "CVE-2026-44022",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-24T18:17:17.593",
  "lastModified": "2026-10-25T22:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \\includegraphics, \\input, and \\include commands lacked path containment validation. Attackers could craft malicious LaTeX documents with path traversal sequences to read arbitrary files from the file system accessible to the process, include sensitive files in the converted document output, or potentially access configuration files, credentials, or other sensitive data This vulnerability is fixed in 2.91.0."
    },
    {
      "lang": "es",
      "value": "Docling simplifica el procesamiento de documentos analizando diversos formatos y proporcionando integraciones con el ecosistema de IA generativa. Desde la versión 2.73.0 hasta la 2.91.0, el manejo del backend de LaTeX de los comandos \\includegraphics, \\input y \\include carecía de validación de contención de ruta. Los atacantes podían crear documentos LaTeX maliciosos con secuencias de salto de ruta para leer archivos arbitrarios del sistema de archivos accesible al proceso, incluir archivos sensibles en la salida del documento convertido o, potencialmente, acceder a archivos de configuración, credenciales u otros datos sensibles. Esta vulnerabilidad se corrigió en la versión 2.91.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "docling-project",
          "product": "docling",
          "versions": [
            {
              "version": ">= 2.73.0, < 2.91.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-25T13:17:46.252428Z",
          "id": "CVE-2026-44022",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:docling:docling:*:*:*:*:*:python:*:*",
              "versionStartIncluding": "2.73.0",
              "versionEndExcluding": "2.91.0",
              "matchCriteriaId": "DDA643FB-5BC0-4CE7-95D9-3F010EA3D49F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/docling-project/docling/releases/tag/v2.91.0",
      "source": "[email protected]",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-2j5p-7p5m-cvqr",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ]
    }
  ]
}