The vulnerability originates from the InputFormat.JSON_DOCLING backend in docling, which fails to reject picture image references that contain local paths or file URIs. When a DoclingDocument is enriched or exported with ImageRefMode.EMBEDDED, the document processing routine attempts to open those references and embed the image bytes into the output. As a result, an attacker can craft a JSON document that points to local images available to the process, thereby causing the system to read and expose those images. The disclosure is limited to files that Pillow can decode and also reveals whether a particular path exists through decode behavior. This flaw does not allow arbitrary code execution but permits unauthorized reading of local resources and can be used to gain insight into the file system structure.

The affected products are the open‑source docling and docling‑slim projects maintained by docling‑project. Versions from 2.16.0 through 2.131.0 (inclusive) are vulnerable. All releases equal to or newer than 2.131.0 contain the fix that rejects local references when embedding images.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likelihood of exploitation depends on how the vulnerable application is exposed: if it accepts untrusted JSON inputs from external sources, an attacker can supply a crafted document to trigger local file disclosure. The impact is limited to read‑only access to image files that Pillow can decode; the flaw does not provide a path traversal that can reach arbitrary files, but it does leak existence information. Overall, the risk is moderate and mitigated by applying the official patch.