CVE-2026-44017: Docling Zip Slip RCE Vulnerability

CVE-2026-44017 Overview

CVE-2026-44017 is a path traversal vulnerability [CWE-22] in Docling, a document processing library that integrates with generative AI ecosystems. Versions prior to 2.91.0 extract ZIP archives from the EasyOCR model download process without validating member paths. This flaw enables Zip Slip attacks, allowing arbitrary file writes outside the intended extraction directory. Exploitation requires an attacker to compromise the model download source through a supply chain attack, DNS spoofing, or man-in-the-middle (MITM) interception. Successful attacks can lead to remote code execution, persistent backdoors, or data corruption. The maintainers fixed the issue in Docling 2.91.0.

Critical Impact
Attackers who control the EasyOCR model download channel can write arbitrary files to any location writable by the Docling process, enabling remote code execution and persistence.

Affected Products

Docling versions prior to 2.91.0
Docling deployments using EasyOCR model download functionality
Python environments integrating Docling for document parsing workflows

Discovery Timeline

2026-06-24 - CVE-2026-44017 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-44017

Vulnerability Analysis

Docling parses diverse document formats and provides integrations with generative AI tooling. The EasyOCR integration downloads model files packaged as ZIP archives and extracts them locally before inference. The extraction logic processes archive entries without validating the destination path of each member.

A ZIP archive entry can contain relative path components such as ../../ in its filename field. When the extraction routine joins these names to the target directory without canonicalization, the resulting write path escapes the intended directory. This pattern, known as Zip Slip, allows an attacker who controls archive contents to overwrite files anywhere the Docling process can write.

The vulnerability is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Root Cause

The model download function fails to canonicalize and validate ZIP member paths before writing files to disk. The code trusts archive entry names as supplied, allowing relative path traversal sequences to redirect file writes outside the extraction root.

Attack Vector

Exploitation requires the attacker to control the model archive delivered to the victim. An attacker can achieve this through compromise of the upstream EasyOCR model hosting infrastructure, DNS spoofing against the download endpoint, or MITM interception of the download traffic. Once a malicious archive is delivered, extraction writes attacker-controlled files to attacker-chosen paths.

Post-exploitation outcomes include overwriting Python source files imported by the application for remote code execution, modifying shell startup scripts or SSH authorized_keys for persistence, and replacing system binaries the process has permission to write. The high attack complexity reflects the prerequisite of controlling the download channel.

No public proof-of-concept exploit code is available. See the GitHub Security Advisory GHSA-cjqg-rq2h-2fvj for additional technical context.

Detection Methods for CVE-2026-44017

Indicators of Compromise

Unexpected files written outside the Docling model cache directory during or after model download operations
Modified Python files, startup scripts, or SSH key files with timestamps correlating to Docling execution
Network connections from Docling processes to non-canonical or unexpected hosts during model retrieval
ZIP archives in the Docling cache containing entries with .. path components

Detection Strategies

Inventory Python environments and identify Docling installations below version 2.91.0 using pip show docling
Inspect file system audit logs for write operations outside expected model cache paths performed by the Python interpreter running Docling
Validate the integrity of downloaded EasyOCR model archives against known hashes before extraction
Monitor outbound DNS resolution for EasyOCR model hosts and flag anomalies suggesting spoofing

Monitoring Recommendations

Enable file integrity monitoring on directories holding Python site-packages, user shell profiles, and SSH key stores
Log and review TLS certificate fingerprints for model download endpoints to detect MITM interception
Alert on process creation chains where Docling-related Python processes spawn shells or write to system binary paths

How to Mitigate CVE-2026-44017

Immediate Actions Required

Upgrade Docling to version 2.91.0 or later in all environments where document processing pipelines run
Audit hosts that have executed vulnerable Docling versions for unexpected file modifications under user home directories and Python package paths
Restrict the Docling runtime to a least-privilege service account that cannot write to system binaries or SSH key locations
Pin model archive hashes and verify them before extraction in automated pipelines

Patch Information

The Docling maintainers released the fix in version 2.91.0. Upgrade using pip install --upgrade docling. Details are available in the GitHub Release v2.91.0 notes and the GitHub Security Advisory GHSA-cjqg-rq2h-2fvj.

Workarounds

Block outbound network access from Docling hosts and pre-stage validated EasyOCR model archives from a trusted internal mirror
Run Docling inside a container or sandbox with a read-only file system outside the model cache directory
Enforce HTTPS certificate pinning for model download endpoints to reduce MITM exposure
Disable the EasyOCR backend if it is not required by the document processing workflow

bash

# Upgrade Docling to the patched release
pip install --upgrade 'docling>=2.91.0'

# Verify the installed version
python -c "import docling; print(docling.__version__)"