Executive brief
Docling is a tool used to convert various document formats into formats suitable for AI applications. A security flaw in how it downloads AI models could allow an attacker to overwrite critical system files if they can intercept the download process. This could lead to complete system takeover, data theft, or permanent backdoors on the affected machine.
Technical details
A path traversal vulnerability (Zip Slip) exists in Docling's EasyOCR model download functionality prior to version 2.91.0. The component extracts ZIP archives without validating that the member paths remain within the intended target directory. An attacker who can compromise the download source—via a supply chain attack, DNS spoofing, or a Man-in-the-Middle (MITM) attack—can provide a malicious archive containing files with '..' sequences. This allows the attacker to write arbitrary files to any location writable by the process, potentially overwriting Python scripts or system binaries to achieve remote code execution. The fix in version 2.91.0 implements path validation using os.path.realpath() to ensure all extracted files stay within the designated directory.
Affected products
- docling-project Docling < 2.91.0
Timeline
- 2026-06-02: advisory: GitHub Security Advisory published
- 2026-04-23: patched: Version 2.91.0 released
- 2026-06-24: disclosed: CVE published to NVD