CVE-2026-47214 Overview
CVE-2026-47214 affects Docling, an open-source document processing library that parses diverse formats and integrates with generative AI ecosystems. The vulnerability resides in the HTML backend, which performs unsafe URI and path handling. Attackers can exploit this weakness through crafted HTML documents processed by the library. The issue is classified under [CWE-73] (External Control of File Name or Path). Versions prior to 2.94.0 are affected, and the fix is available in release 2.94.0.
Critical Impact
Processing a malicious HTML document can trigger unsafe file path or URI resolution, exposing confidential local resources to a remote attacker.
Affected Products
- Docling versions prior to 2.94.0 (Python package docling)
- Applications embedding the Docling HTML backend for document ingestion
- Generative AI pipelines using Docling for HTML parsing
Discovery Timeline
- 2026-06-26 - CVE-2026-47214 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-47214
Vulnerability Analysis
Docling converts documents from multiple formats into structured representations for downstream AI processing. The HTML backend resolves URIs and file paths referenced within HTML inputs to fetch or embed related resources. Prior to version 2.94.0, this resolution logic does not adequately validate or constrain the paths and URIs it processes. An attacker who supplies a crafted HTML document can influence which files or network resources Docling accesses during parsing. The flaw maps to [CWE-73], which covers external control of file name or path. Exploitation requires user interaction, typically opening or processing an attacker-supplied document.
Root Cause
The HTML backend accepts URI and path values from within document content and passes them to file or network handlers without sufficient sanitization. Untrusted input can therefore reference arbitrary local files or remote endpoints. The library trusts document-embedded references rather than restricting them to a safe base directory or scheme allowlist.
Attack Vector
An attacker delivers a malicious HTML document to a user or automated pipeline that processes it with Docling. When the HTML backend resolves embedded references, it may read unintended local files or reach out to attacker-controlled endpoints. The result is disclosure of confidential file contents and limited impact on availability. The vulnerability is network-reachable through document delivery channels such as email attachments, shared drives, and AI ingestion pipelines.
No verified public proof-of-concept exploit is available. See the GitHub Security Advisory GHSA-q29v-xc37-wh5m for maintainer-provided technical details.
Detection Methods for CVE-2026-47214
Indicators of Compromise
- HTML documents containing suspicious file://, \\, or traversal sequences such as ../ in src, href, or resource attributes
- Docling process reads of sensitive files outside the intended document working directory
- Outbound network requests from Docling workers to unexpected external hosts during HTML parsing
Detection Strategies
- Inventory Python environments for the docling package and flag versions earlier than 2.94.0
- Scan HTML documents ingested by AI pipelines for external URI references and path traversal patterns before processing
- Correlate Docling worker file access telemetry with the expected document input directory to surface out-of-scope reads
Monitoring Recommendations
- Log and review all filesystem and network activity performed by processes running Docling HTML parsing
- Alert on Docling processes accessing paths outside their sandbox or document staging directory
- Track pip and dependency manifests in CI to detect downstream services pinned to vulnerable Docling releases
How to Mitigate CVE-2026-47214
Immediate Actions Required
- Upgrade docling to version 2.94.0 or later in all environments that parse untrusted HTML
- Audit AI ingestion pipelines and document processing services for embedded Docling usage
- Restrict Docling execution to sandboxed environments with least-privilege filesystem and network access
Patch Information
The maintainers fixed the unsafe URI and path handling in Docling 2.94.0. Review the Docling v2.94.0 release notes and the GitHub Security Advisory GHSA-q29v-xc37-wh5m for full remediation guidance. Upgrade using pip install --upgrade docling and rebuild any container images that bundle the library.
Workarounds
- Pre-sanitize HTML documents to strip external references and suspicious URI schemes before invoking Docling
- Run Docling workers inside containers with no outbound network access and read-only mounts scoped to the input directory
- Disable or replace the HTML backend for untrusted inputs until upgrade to 2.94.0 is complete
# Upgrade Docling to the patched release
pip install --upgrade 'docling>=2.94.0'
# Verify the installed version
python -c "import docling, importlib.metadata as m; print(m.version('docling'))"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
