The vulnerability arises from unsafe extraction of archives and XML parsing in Docling’s METS-GBS backend. Security checks that should validate archive contents and XML structure are missing, allowing an attacker to craft a malicious METS-GBS archive that, when processed, can cause the application to read arbitrary files on the host, consume excessive CPU or memory resources, or crash. The consequences are sensitive data exposure and denial of service for legitimate users.

Affects docling-project’s Docling application versions 2.45.0 through 2.90.x; the fix was introduced in 2.91.0. Systems that expose the METS-GBS ingestion endpoint are at risk and should use the patched release.

The CVSS score of 5.5 indicates a moderate severity; no EPSS data is available and the vulnerability is not listed in CISA KEV. Attackers can exploit the flaw remotely by submitting crafted METS-GBS archives to the ingestion component. Because the issue involves insufficient input validation, the risk can be mitigated by applying the official patch or restricting upload sources.