Docling Core before version 2.103.0 has a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allow_image_file_uri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported with ImageRefMode.EMBEDDED or rendered to HTML, embeds the referenced local image files as base64, revealing the file contents and confirming path existence. This is a CWE‑73 weakness.

The affected product is Docling Core from the docling-project. All versions up to and including 2.102.0 are vulnerable; no information is provided for newer releases, so administrators should verify whether an upgraded version is in use. Vendor repository and advisory links confirm the issue exists in 2.102.0.

The CVSS score of 5.3 indicates moderate severity and an EPSS score is not available. The bug is not listed in the CISA KEV catalog, and no public exploit is known. The attack vector requires the ability to supply a malicious document to the system; if the system accepts untrusted documents, any actor with that ability can read local images and confirm path existence. Although the exploit does not grant arbitrary code execution, it can leak sensitive file contents and aid subsequent attacks.