Docling Core Unsafe Remote Filename Resolution Vulnerability Allowing SSRF

A vulnerability in Docling Core versions 1.5.0 and above, prior to 2.74.1, allowed for unsafe resolution of server-provided Content-Disposition headers to local paths. This issue could be exploited in applications that accept untrusted URLs, leading to Server-Side Request Forgery (SSRF) attacks that target local files outside the user-defined cache directory.

Impact

Exploitation of this vulnerability could result in unauthorized access to local files, potentially leading to the disclosure of sensitive information.

Remediation

Users are advised to upgrade to Docling Core version 2.74.1 or later. If an immediate upgrade is not possible, avoid using untrusted URLs with the remote fetch functionality.