# CVE-2026-105748: IBM Docling arbitrary local file read via JSON backend

Source: https://junglewise.ai/threats/cve-2026-105748-docling-simplifies-document-processing-by-parsing-diverse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105748 · Severity: medium · CVSS 4.3 · Published 2026-10-05

Docling is a document processing library that converts various file formats and integrates with AI models. An attacker can craft a malicious JSON document containing references to local files or file:// URIs; when the document is processed with image embedding enabled, the library loads and exposes the image data in the output, allowing unauthorized access to local files on the system.

Technologies: [IBM Docling](https://junglewise.ai/threats/technologies/docling), [docling (PyPI)](https://junglewise.ai/threats/technologies/pypi-docling), [docling-slim (PyPI)](https://junglewise.ai/threats/technologies/docling-slim). Vendors: [IBM](https://junglewise.ai/threats/vendors/ibm), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-105748 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105748 being exploited in the wild.

**How severe is CVE-2026-105748?** Medium severity, with a CVSS score of 4.3, published 5 October 2026.

**Which products and versions are affected?** IBM Docling 2.16.0 to 2.130.x; docling (PyPI) >= 2.16.0, < 2.131.0, ECOSYSTEM:introduced=2.16.0,fixed=2.131.0; docling-slim (PyPI) >= 2.92.0, < 2.131.0, ECOSYSTEM:introduced=2.92.0,fixed=2.131.0.

**Is there a fix for CVE-2026-105748?** Yes. docling (PyPI): upgrade to 2.131.0 or later; docling-slim (PyPI): upgrade to 2.131.0 or later. Until then: Enable the enable_local_fetch option only when processing trusted JSON documents, or upgrade to the patched version. By default, local file references in JSON input are now dropped unless explicitly enabled. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105748 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-105748?** Check whether you run IBM Docling, docling (PyPI) or docling-slim (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- docling (PyPI): upgrade to 2.131.0 or later

  ```sh
  pip install "docling>=2.131.0"
  ```

- docling-slim (PyPI): upgrade to 2.131.0 or later

  ```sh
  pip install "docling-slim>=2.131.0"
  ```


Enable the enable_local_fetch option only when processing trusted JSON documents, or upgrade to the patched version. By default, local file references in JSON input are now dropped unless explicitly enabled.

## Technical details

The InputFormat.JSON_DOCLING backend fails to reject image references containing local paths or file:// URIs during JSON document validation. When DoclingDocument._with_embedded_pictures or ImageRef.pil_image methods are invoked during enrichment or export with ImageRefMode.EMBEDDED, these local file references are opened via Pillow, embedding readable image bytes in Markdown or HTML output. An attacker supplies a crafted JSON document with local file image references; a user processes it with embedding enabled; readable file contents leak into exported documents.

## Affected products

- IBM Docling 2.16.0 to 2.130.x

## Identifiers

- CVE-2026-105748
- GHSA-p944-4xh2-x776
- PYSEC-2026-4208
- PYSEC-2026-4213

## Timeline

- 2026-10-05: disclosed
- 2026-09-29: patched

## References

- [https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4](https://github.com/docling-project/docling/commit/d4bb776884aba9aa3132f54773f420853cf7afe4)
- [https://github.com/docling-project/docling/pull/4417](https://github.com/docling-project/docling/pull/4417)

## Related threats

- [Docling METS-GBS archive member limit enforced after full enumeration](https://junglewise.ai/threats/duplicate-advisory-docling-mets-gbs-archive-member-limit-enforced-after-087423a8)
- [Docling arbitrary filesystem read via unvalidated xlink:href in ODF images](https://junglewise.ai/threats/cve-2026-105751-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling local file disclosure in HTML rendering](https://junglewise.ai/threats/cve-2026-105750-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling unbounded table span allocation denial of service](https://junglewise.ai/threats/cve-2026-105749-docling-simplifies-document-processing-by-parsing-diverse)
- [Docling memory exhaustion in METS-GBS tar archive processing](https://junglewise.ai/threats/cve-2026-105747-docling-simplifies-document-processing-by-parsing-diverse)