What’s Vulnerable › Vulnerabilities

CVE-2026-44022: Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-24 · updated 2026-10-25
• Weakness: CWE-22

Description

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.73.0 until 2.91.0, he LaTeX backend's handling of \includegraphics, \input, and \include commands lacked path containment validation. Attackers could craft malicious LaTeX documents with path traversal sequences to read arbitrary files from the file system accessible to the process, include sensitive files in the converted document output, or potentially access configuration files, credentials, or other sensitive data This vulnerability is fixed in 2.91.0.

Affected products

• docling-project docling: from 2.73.0 before 2.91.0 — fixed in 2.91.0

How to fix

Upgrade to a fixed version: docling-project docling 2.91.0. Check the vendor advisory for mitigations.

References

• https://github.com/docling-project/docling/releases/tag/v2.91.0
• https://github.com/docling-project/docling/security/advisories/GHSA-2j5p-7p5m-cvqr

Get alerted when CVE-2026-44022 or the next vulnerability affects your stack