CVE-2026-44018

MEDIUM

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause application crashes. This vulnerability is fixed in 2.91.0.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Published: 6/26/2026Modified: 6/27/2026

Related Intelligence (1)

HIGHVulnerability

NVD HIGH: CVE-2026-44018 — Docling simplifies document processing by parsing diverse formats and providing ...

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS archives that, when processed, could read sensitive files, exhaust system resources, or cause applicati

CVE-2026-44018
NIST NVD

References (2)

https://github.com/docling-project/docling/releases/tag/v2.91.0Release Noteshttps://github.com/docling-project/docling/security/advisories/GHSA-r3xg-rg9j-67fvPatchVendor Advisory