CVE-2026-44022: Docling LaTeX Path Traversal Arbitrary File Read Vulnerability

Technical summary

The vulnerability exists in Docling's LaTeX backend processing of \includegraphics, \input, and \include commands. These commands are used in LaTeX to reference external files, but Docling versions 2.73.0 through 2.90.x fail to validate or constrain the file paths supplied in these commands. An attacker can use path traversal sequences (such as ../ or absolute paths) to reference files outside the intended document directory. When Docling processes such a document, it resolves these paths against the host file system without restriction, allowing arbitrary file reads. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has a CVSS 3.1 score of 5.5 (Medium severity).

Business impact

For organizations using Docling to process user-supplied or third-party LaTeX documents, this vulnerability can lead to information disclosure. A compromised document could leak credentials stored in environment files, configuration secrets, API keys, or other sensitive data accessible to the Docling service account. The impact is particularly acute in automated document processing pipelines where LaTeX files are received from external sources without thorough manual review. While integrity and availability are not directly affected, the confidentiality breach could enable follow-on attacks if leaked credentials provide access to downstream systems or repositories.

Affected systems

Docling versions 2.73.0 through 2.90.x are vulnerable. Version 2.91.0 and later contain the fix. Any deployment running Docling within this version range that processes LaTeX documents is at risk. This includes applications integrated with Docling's generative AI ecosystem features, document conversion services, and data pipeline stages that accept LaTeX as input.

Exploitability

Exploitation requires that an attacker supply a malicious LaTeX document to the target system and that a user or automated process triggers Docling's processing of that document. The attack vector is local (the LaTeX file must be processed by the local Docling instance), and no special privileges are required—any user who can cause document processing is sufficient. The UI requirement in the CVSS vector reflects this user interaction dependency. Exploitability is moderate; the barrier is not technical sophistication but rather the attacker's ability to introduce a crafted LaTeX file into a processing workflow.

Remediation

Upgrade Docling to version 2.91.0 or later, which implements path containment validation for LaTeX file inclusion commands. Organizations should prioritize patching systems that process external or untrusted LaTeX documents. For environments where immediate patching is not possible, implement access controls to restrict which files the Docling process can read, and avoid processing LaTeX documents from untrusted sources until the patch is applied.

Patch guidance

Verify your current Docling version and upgrade to 2.91.0 or the latest available version. Consult the vendor advisory for any compatibility notes or breaking changes. If Docling is embedded in a larger application or framework, check for dependency management updates and test the upgrade in a staging environment before deploying to production. Automated dependency scanning tools should flag this vulnerability in affected version ranges.

Detection guidance

Monitor for Docling process access to files outside expected document directories, particularly configuration files, credential stores, or parent directories. Log LaTeX document processing events and inspect for path traversal patterns in filenames or command arguments (sequences like ../, /etc/, or absolute paths). In development and CI/CD environments, review documents being processed for suspicious LaTeX inclusion commands. Network-based detection is limited due to the local attack vector; focus on endpoint and application logging.

Why prioritize this

Although rated Medium severity, this vulnerability should be prioritized for any environment processing external LaTeX documents because information disclosure can expose credentials and configuration secrets that enable lateral movement or further compromise. The fix is straightforward (upgrade to 2.91.0), making remediation low-friction. Organizations handling document conversion as a service or accepting user uploads should treat this as higher priority.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a high confidentiality impact (C:H) balanced against local attack vector and required user interaction. The score does not account for business context—if Docling processes documents containing highly sensitive data or if the service account has broad file system permissions, the practical risk may exceed the base score. Conversely, if Docling is sandboxed with restricted file system access, risk is reduced. Adjust prioritization based on your specific use case and data sensitivity.

Frequently asked questions