CVE-2026-44022 Overview
CVE-2026-44022 is a path traversal vulnerability [CWE-22] in Docling, an open-source library that parses diverse document formats for integration with generative AI pipelines. The LaTeX backend fails to validate paths passed to \includegraphics, \input, and \include commands. Attackers can craft malicious LaTeX documents containing path traversal sequences to read arbitrary files accessible to the Docling process. The flaw affects versions 2.73.0 through versions prior to 2.91.0 and is fixed in 2.91.0.
Critical Impact
Attackers can exfiltrate sensitive files including configuration data, credentials, and other process-accessible files by embedding traversal sequences in LaTeX documents submitted for conversion.
Affected Products
- Docling versions 2.73.0 through 2.90.x
- LaTeX backend document conversion component
- Applications and AI pipelines that ingest untrusted LaTeX documents via Docling
Discovery Timeline
- 2026-06-24 - CVE-2026-44022 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-44022
Vulnerability Analysis
Docling converts documents from formats such as PDF, DOCX, and LaTeX into structured representations consumed by generative AI workflows. The LaTeX backend processes file-inclusion commands that reference external resources by path. The backend resolves these paths without enforcing containment within an expected base directory.
An attacker supplies a LaTeX document containing directives such as \input, \include, or \includegraphics with relative path traversal sequences. When Docling processes the document, it reads the referenced files and may embed their contents in the converted output. The local attack vector requires user interaction, since a victim must initiate document conversion on the attacker-supplied input.
The issue is classified as Path Traversal [CWE-22]. The confidentiality impact is high, while integrity and availability are unaffected, since the flaw exposes file contents without modifying them.
Root Cause
The LaTeX backend lacks path containment validation when handling \includegraphics, \input, and \include commands. The backend trusts user-supplied paths and does not canonicalize the resolved location against an allowed base directory before opening the file.
Attack Vector
An attacker creates a LaTeX file referencing sensitive paths through relative traversal sequences such as ../../../../etc/passwd or absolute paths pointing to credential stores, environment files, or application configuration. When the document is submitted to a Docling-powered pipeline, the backend resolves the path, reads the file, and includes the contents in the converted output that may be returned to the attacker.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-2j5p-7p5m-cvqr for the maintainer's technical description.
Detection Methods for CVE-2026-44022
Indicators of Compromise
- LaTeX source documents containing \input, \include, or \includegraphics directives with ../ traversal sequences or absolute paths referencing system directories
- Docling process file access events targeting /etc/, ~/.ssh/, .env files, or cloud credential paths not normally read during document conversion
- Converted document outputs containing fragments of system configuration, credentials, or keys
Detection Strategies
- Inspect LaTeX inputs prior to conversion for inclusion directives that reference paths outside the intended document working directory
- Audit Docling worker file-access telemetry for reads of sensitive paths during conversion jobs
- Compare converted output sizes and contents against expected baselines to flag unexpected embedded file contents
Monitoring Recommendations
- Log all Docling conversion jobs with input file hashes, source identifiers, and the resolved file paths read during processing
- Alert on Docling processes opening files outside the document staging directory
- Track installed Docling versions across services to identify hosts running vulnerable releases between 2.73.0 and 2.91.0
How to Mitigate CVE-2026-44022
Immediate Actions Required
- Upgrade Docling to version 2.91.0 or later on all systems that process LaTeX documents
- Inventory pipelines and services that accept user-supplied LaTeX input and prioritize patching of internet-exposed conversion endpoints
- Run Docling conversion workers under a least-privileged service account with no access to credentials, secrets, or other sensitive files
Patch Information
The maintainers fixed the vulnerability in Docling 2.91.0. Release notes are available in the GitHub Release v2.91.0 page. Upgrade using the project's standard installation channel, for example pip install --upgrade docling.
Workarounds
- Disable or block ingestion of LaTeX documents until the upgrade is applied
- Execute Docling inside a sandbox or container with a read-only filesystem mount limited to the document working directory
- Pre-process LaTeX inputs to strip or reject \input, \include, and \includegraphics directives containing .. or absolute paths
# Configuration example
pip install --upgrade 'docling>=2.91.0'
pip show docling | grep -i version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
