Is CVE-2026-105748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105748 being exploited in the wild.

How severe is CVE-2026-105748?

Medium severity, with a CVSS score of 4.3, published 5 October 2026.

Which products and versions are affected?

IBM Docling 2.16.0 to 2.130.x; docling (PyPI) >= 2.16.0, = 2.92.0, < 2.131.0, ECOSYSTEM:introduced=2.92.0,fixed=2.131.0.

How is CVE-2026-105748 attacked?

It is attacked over the network.

Am I affected by CVE-2026-105748?

Check whether you run IBM Docling, docling (PyPI) or docling-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105748: IBM Docling arbitrary local file read via JSON backend

Q: Is there a fix for CVE-2026-105748?

Yes. docling (PyPI): upgrade to 2.131.0 or later; docling-slim (PyPI): upgrade to 2.131.0 or later. Until then: Enable the enable_local_fetch option only when processing trusted JSON documents, or upgrade to the patched version. By default, local file references in JSON input are now dropped unless explicitly enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-105748 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-105748?

Check whether you run IBM Docling, docling (PyPI) or docling-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105748 · Severity: medium · CVSS 4.3 · Published 2026-10-05

Docling is a document processing library that converts various file formats and integrates with AI models. An attacker can craft a malicious JSON document containing references to local files or file:// URIs; when the document is processed with image embedding enabled, the library loads and exposes the image data in the output, allowing unauthorized access to local files on the system.

Technologies: IBM Docling, docling (PyPI), docling-slim (PyPI). Vendors: IBM, PyPI.

Quick answers

Is CVE-2026-105748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105748 being exploited in the wild.
How severe is CVE-2026-105748?: Medium severity, with a CVSS score of 4.3, published 5 October 2026.
Which products and versions are affected?: IBM Docling 2.16.0 to 2.130.x; docling (PyPI) >= 2.16.0, < 2.131.0, ECOSYSTEM:introduced=2.16.0,fixed=2.131.0; docling-slim (PyPI) >= 2.92.0, < 2.131.0, ECOSYSTEM:introduced=2.92.0,fixed=2.131.0.
Is there a fix for CVE-2026-105748?: Yes. docling (PyPI): upgrade to 2.131.0 or later; docling-slim (PyPI): upgrade to 2.131.0 or later. Until then: Enable the enable_local_fetch option only when processing trusted JSON documents, or upgrade to the patched version. By default, local file references in JSON input are now dropped unless explicitly enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105748 attacked?: It is attacked over the network.
Am I affected by CVE-2026-105748?: Check whether you run IBM Docling, docling (PyPI) or docling-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

docling (PyPI): upgrade to 2.131.0 or later
```
pip install "docling>=2.131.0"
```
docling-slim (PyPI): upgrade to 2.131.0 or later
```
pip install "docling-slim>=2.131.0"
```

Enable the enable_local_fetch option only when processing trusted JSON documents, or upgrade to the patched version. By default, local file references in JSON input are now dropped unless explicitly enabled.

Technical details

The InputFormat.JSON_DOCLING backend fails to reject image references containing local paths or file:// URIs during JSON document validation. When DoclingDocument._with_embedded_pictures or ImageRef.pil_image methods are invoked during enrichment or export with ImageRefMode.EMBEDDED, these local file references are opened via Pillow, embedding readable image bytes in Markdown or HTML output. An attacker supplies a crafted JSON document with local file image references; a user processes it with embedding enabled; readable file contents leak into exported documents.

Affected products

IBM Docling 2.16.0 to 2.130.x

Identifiers

CVE-2026-105748
GHSA-p944-4xh2-x776
PYSEC-2026-4208
PYSEC-2026-4213

Timeline

2026-10-05: disclosed
2026-09-29: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.