CVE-2026-44017: Docling Zip Slip Vulnerability Enables Remote Code Execution

Technical summary

CVE-2026-44017 is a Zip Slip vulnerability (CWE-22) in Docling's EasyOCR model download handler. The library extracts ZIP archives without canonicalizing or validating member paths, allowing path traversal sequences (e.g., '../../../') to write files outside the intended extraction directory. An attacker controlling the source of the downloaded model file can craft a malicious ZIP that, when extracted, overwrites Python bytecode files, system binaries, SSH keys, or shell initialization scripts. The attack surface is conditional on network-level compromise (MITM, DNS hijacking) or supply chain poisoning of the model repository, but once achieved, the consequences include arbitrary code execution in the application's process context. Fixed in version 2.91.0 through proper path validation during archive extraction.

Business impact

Organizations relying on Docling for document processing workflows face supply chain risk. If model downloads are compromised, attackers gain code execution within the host or container running the application, potentially enabling lateral movement, data exfiltration, or persistent backdoors. The impact is elevated for enterprises processing sensitive documents (financial records, legal documents, medical data) or running Docling in CI/CD pipelines or automated batch processing systems. Persistent backdoors could survive patching if attacker-modified startup scripts are not detected and cleaned.

Affected systems

Docling versions prior to 2.91.0 are affected. All deployments using the EasyOCR model download feature are at risk if their network path to the model source is not properly secured. This includes on-premises installations, cloud deployments, and containerized environments (Docker, Kubernetes) where Docling initializes model downloads at startup or on first use.

Exploitability

Exploitation requires network-level control or compromise of the model repository source. While not trivially exploitable off-the-shelf, the barrier is moderate: successful exploitation of any MITM vector (unencrypted or poorly validated HTTPS, DNS spoofing on internal networks) or compromise of the upstream model repository immediately enables arbitrary file writes and code execution. The CVSS score of 7.5 reflects HIGH severity with high impact but conditional attack complexity (AC:H), appropriately accounting for the prerequisite network compromise.

Remediation

Upgrade Docling to version 2.91.0 or later immediately. The patch validates archive member paths before extraction, preventing traversal sequences from writing outside the intended directory. Organizations should verify that model downloads occur over secured, validated HTTPS connections and consider pinning model hashes or using a trusted local model cache to reduce exposure to remote source compromise.

Patch guidance

Update Docling to 2.91.0 or any subsequent version. Verify the patch by checking release notes or code diffs confirming ZIP extraction path validation. If running Docling in a CI/CD pipeline or container, ensure the base image or dependency lock includes the patched version. After patching, consider a one-time manual validation of any previously downloaded models, especially if your environment was potentially exposed to untrusted network paths during the vulnerable window.

Detection guidance

Monitor for ZIP extraction operations in Docling process activity; unusual file writes outside expected model directories may indicate exploitation. Check logs for failed or suspicious model downloads. Audit network traffic to confirm model downloads use validated HTTPS with certificate pinning where feasible. Review file system integrity of Python site-packages directories and startup scripts for signs of unauthorized modification. Organizations using software composition analysis (SCA) tools should flag Docling <2.91.0 in dependency inventories.

Why prioritize this

Although KEV inclusion is not applicable and real-world exploitation requires prior network compromise, the consequence severity (arbitrary code execution and persistence) combined with the prevalence of Docling in AI/ML and document processing pipelines justifies HIGH priority patching. Supply chain attacks and MITM vectors are increasingly common; organizations cannot assume their download paths are always secure.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) appropriately balances impact and exploitability. Attack Vector (Network) and User Interaction (Required) reflect that attackers must compromise the remote source or network path. The high Impact scores (Confidentiality, Integrity, Availability all H) reflect the full scope of post-exploitation damage (code execution, file overwrite, persistence). Attack Complexity (High) accounts for the prerequisite compromise step. The overall rating correctly positions this as a serious but non-trivial vulnerability.

Frequently asked questions