Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 25 Oct 2026 00:10:11 +0000 CVE-2026-112310 — docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef https://db.gcve.eu/vuln/cve-2026-112310 <p><strong>Affected:</strong> docling-project docling-core</p> <p>docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.</p> <p><strong>Affected:</strong> docling-project docling-core</p> <p>docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds readable local image files as base64 and reveals path existence.</p> https://db.gcve.eu/vuln/cve-2026-112310