The vulnerability lies in Docling’s HTML backend, which processes URI and file path inputs without adequate restrictions. This flaw permits an attacker to craft requests that reference files outside the intended directory, allowing the reading of sensitive data that should not be exposed through the web interface. The defect does not facilitate arbitrary code execution or system‑wide compromise but could lead to unintended disclosure of files, and the unchecked handling may also allow an attacker to consume excessive system resources, potentially causing a denial of service.

All releases of the docling‑project:docling product prior to version 2.94.0 are affected. The issue resides in the HTML backend component of the Docling suite.

The CVSS score of 7.1 places the issue in the moderate‑to‑high severity range, and the EPSS score of less than 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector, inferred from the description, involves a network‑exposed endpoint of the HTML backend where an attacker can send specially crafted URI or path parameters to traverse directories and retrieve confidential files. Acquisition of privileged local access is not required for exploitation.