File and Path Handling

Every one of the 10 is a mark on the map. Named now: 1 to 10, most at risk first.

1. Docling: Unsafe Zip Extraction in EasyOCR Model DownloadCVE-2026-44017docling-project · CVSS 7.5 · 0.7% likely

   CWE-22

2. Docling Core has unsafe remote filename resolutionCVE-2026-44023docling-project · CVSS 8.6 · 0.4% likely

   CWE-22

3. Docling Core has insufficient validation of image reference URIsCVE-2026-44019docling-project · CVSS 8.1 · 0.4% likely

   CWE-73

4. Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backendCVE-2026-105751docling-project · CVSS 6.9 · 0.4% likely

   CWE-22

5. Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modeCVE-2026-105750docling-project · CVSS 5.9 · 0.4% likely

   CWE-552

6. Docling: Unsafe URI and Path Handling in HTML BackendCVE-2026-47214docling-project · CVSS 7.1 · 0.4% likely

   CWE-73

7. Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engineCVE-2026-105744docling-project · CVSS 7.5 · 0.4% likely

   CWE-22

8. docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRefCVE-2026-112310docling-project · CVSS 4.3 · 0.3% likely

   CWE-73

9. Docling: Crafted DoclingDocument JSON embeds local image files into converted outputCVE-2026-105748docling-project · CVSS 4.3 · 0.3% likely

   CWE-73

10. Docling: Potential Path Traversal via LaTeX \includegraphics and \input CommandsCVE-2026-44022docling-project · CVSS 5.5 · 0.2% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.