CVE-2026-105751 is a High severity path traversal flaw in Docling's OpenDocument backend. From 2.107.0 until 2.120.3, an image reference in a crafted ODT, ODS or ODP file is used as a filesystem path, so readable image files on the host can be embedded in the converted output. Upgrade to 2.120.3.
What's affected
- Package: docling (pip), from 2.107.0 until 2.120.3.
- Fixed: 2.120.3.
- Component: docling/backend/opendocument_backend.py, in the image reference handling for draw:image elements.
- Condition: converting an OpenDocument file from an untrusted source.
- Limit: the target must decode as an image, since the record says readable files that Pillow can decode are embedded.
The record scores this 7.5 High, while the project advisory labels it Moderate. Both are given here. The advisory also lists affected versions as 2.107.0 and later with 2.120.3 as the patched version.
How to check if you're exposed
Docling is a Python package, and it also ships as docling-slim, so check both.
pip show docling docling-slim
pip freeze | grep -i docling
grep -ri "docling" requirements*.txt pyproject.toml poetry.lock uv.lock 2>/dev/null
Check services that convert uploaded documents, notebooks, batch jobs and container images. Then check how Docling is configured, because every Docling advisory in this series depends on a specific option or file type, as described above.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads a manifest or lockfile and shows which packages carry known CVEs, including this one. Nothing is installed and nothing leaves your browser session beyond the scan itself.
Then consider the inputs. The path is reached only when Docling converts OpenDocument formats. If your service accepts only PDF or Word files, it is not in play. If it accepts ODT, ODS or ODP uploads, it is.
What to do now
- Upgrade docling and docling-slim to 2.120.3 or later.
- Restrict accepted upload types to the formats you need, and drop OpenDocument if you do not use it.
- Convert untrusted files inside a container or sandbox with no sensitive files mounted.
- Review past converted output for images that look unrelated to the source document.
- Read the fix pull request, which resolves the image reference through the same loader and settings the other backends use.
- Re-scan after upgrading to confirm no copy of an older release remains.
Why it matters
The record lists CWE-22, path traversal. The advisory says the backend treated the image link inside the document as a path on the host whenever the referenced part was missing from the archive. It applied no scheme check, no folder confinement and no consultation of the local fetch controls that the other backends use.
The key point is where the value comes from: it is document content, chosen by the author of the file. A converter that follows such a path is a confused deputy that reads files for a stranger. The advisory says the contents can then show up in the HTML, Markdown and JSON exports.
The limit that the file must decode as an image narrows what can be read, but images, scans and some secrets stored as images are still sensitive. The record does not list the CVE as exploited in the wild. The pattern is general: any converter that resolves references inside untrusted files needs the same fetch controls on every format.
Quick check
Does this affect PDF conversion?
No. The record ties the issue to the OpenDocument backend only.
Which file types are readable?
The record says readable files that Pillow can decode as images can be embedded in the output.
Sources
- Docling GitHub security advisory GHSA-4xhp-xg4w-8ppm
- Docling release v2.120.3
- Docling pull request 4015
Last reviewed: 18 October 2026.
