CVE-2026-47214: Docling HTML Backend URI/Path Handling Vulnerability

Technical summary

CVE-2026-47214 exploits unsafe URI and path handling in Docling's HTML backend. The vulnerability maps to CWE-400 (Uncontrolled Resource Consumption) and CWE-73 (External Control of File Name or Path), indicating that the HTML parser fails to properly validate and sanitize resource references before processing. This allows attackers to craft documents containing malicious URI references that trigger uncontrolled resource consumption or path traversal conditions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) reflects that exploitation requires network access and user interaction, but results in high confidentiality impact and limited availability impact.

Business impact

Organizations using Docling for document processing—particularly those integrating it into AI pipelines or customer-facing document analysis workflows—face two primary risks: confidential information disclosure when processing untrusted documents, and service degradation if an attacker sends documents that exhaust computational resources. The user-interaction requirement limits automated attack scenarios but remains significant if your application processes documents from external sources or allows users to upload files. Downstream AI applications relying on Docling output could also be exposed to manipulated or incomplete data.

Affected systems

All versions of Docling prior to 2.94.0 are affected. The vulnerability is specific to the HTML backend's URI and path handling, so organizations should audit which document formats trigger HTML parsing and whether those documents originate from untrusted sources. Applications using Docling as a dependency should verify their current version and upgrade paths.

Exploitability

The vulnerability requires a user or automated system to process a specially crafted document, making it not immediately exploitable in passive contexts. However, if your organization processes documents from external sources—such as customer uploads, email attachments, or public repositories—the attack surface is substantial. An attacker can distribute malicious documents through common channels (email, document sharing platforms, or supply-chain vectors) and reasonably expect them to be processed. The attack does not require authentication or special privileges, only that the document be parsed by an affected Docling version.

Remediation

Upgrade Docling to version 2.94.0 or later, which addresses the unsafe URI and path handling in the HTML backend. If immediate upgrade is not possible, implement strict input validation on documents before passing them to Docling—restrict accepted file types to those not using HTML parsing, or sandbox Docling processing in isolated environments with resource limits. Monitor for unexpected resource consumption during document processing.

Patch guidance

Update your Docling dependency to 2.94.0 or newer via your package manager (pip for Python environments). Verify the update by checking your installed version and testing with a representative sample of your document workload. If Docling is vendored or pinned in your supply chain, coordinate the update with your build and deployment processes. Consult the official Docling project repository and release notes to confirm the patch is available and compatible with your Python version and other dependencies.

Detection guidance

Monitor for abnormal resource consumption (CPU, memory, disk I/O) during document processing operations. Log and review which document formats and sources trigger HTML backend processing. If possible, instrument Docling's initialization or parsing calls to capture the URI and path references it encounters, flagging any that appear malformed or reference unexpected system paths. Intrusion detection systems can flag HTTP requests attempting to deliver documents with suspicious embedded URIs, though this requires understanding your typical document sources.

Why prioritize this

This is a high-severity vulnerability with network-exploitable attack vector and user-interaction requirement. The combination of high confidentiality impact and the likelihood that many organizations process external documents elevates priority. However, organizations that only process internal, trusted documents or do not use the HTML backend can deprioritize relative to other exposures. Assess your document intake workflows and whether Docling processes untrusted sources.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects the network-accessible attack vector, low attack complexity, and absence of privilege requirements, balanced against the user-interaction requirement and limited scope. The high confidentiality impact and moderate availability impact justify the elevated score. The score does not account for your organization's specific use case; those processing only internal documents should interpret risk as lower, while those with public document upload capabilities should treat it as more urgent.

Frequently asked questions