Docling Core versions 1.5.0 through 2.74.0 contain path traversal and server-side request forgery vulnerabilities that permit unauthorized file access and network interaction.

This vulnerability involves improper limitation of pathnames to restricted directories and server-side request forgery. These flaws allow unauthenticated remote attackers to interact with local files or perform requests to internal resources.

The combination of path traversal and SSRF allows an attacker to read sensitive files from the server or probe internal network services that are otherwise protected from the public internet. This can lead to the exposure of configuration files, credentials, or internal data, resulting in a significant security breach. The CVSS score of 8.6 confirms the high severity of these combined issues.

Immediate Action: Upgrade to docling-core version 2.74.1 or later to resolve the path traversal and SSRF flaws.

Proactive Monitoring: Audit network logs for unusual outbound connections from the server, which may indicate attempted SSRF exploitation.

Compensating Controls: Ensure the application runs with the minimum necessary filesystem permissions to limit the impact of potential path traversal attempts.

Public Exploit Available: Unknown.

Given the potential for both information disclosure and internal network reconnaissance, users of docling-core must upgrade to version 2.74.1 immediately. Failure to patch leaves the application exposed to unauthorized file access and potential lateral movement within the network.