Summary
Docling's OpenDocument backend may treat an attacker-controlled image reference as a filesystem path when the referenced document part is missing from the archive. A crafted document could cause readable files to be embedded in converted output or allow an attacker to infer whether filesystem paths exist.
Docling's OpenDocument backend may treat an attacker-controlled image reference as a filesystem path when the referenced document part is missing from the archive. A crafted document could cause readable files to be embedded in converted output or allow an attacker to infer whether filesystem paths exist.
Affected context
The issue occurs when Docling processes OpenDocument files containing draw:image elements whose xlink:href references are not resolved within the document archive. In affected processing paths, the backend may access the reference as a local filesystem path without applying the local-fetch policy, restricting access to the extraction directory, or checking for an allowed scheme. Exploitation depends on the converter's filesystem permissions and the presence of readable files that can be decoded or otherwise distinguished.
The issue occurs when Docling processes OpenDocument files containing draw:image elements whose xlink:href references are not resolved within the document archive. In affected processing paths, the backend may access the reference as a local filesystem path without applying the local-fetch policy, restricting access to the extraction directory, or checking for an allowed scheme. Exploitation depends on the converter's filesystem permissions and the presence of readable files that can be decoded or otherwise distinguished.
Exploit preconditions
- Attack surface: OpenDocument file conversion through Docling's ODF backend
- Required access: Ability to submit or cause processing of a crafted document
- Trigger point: Resolution of an external or missing
draw:imagereference - Why exploitation is possible: The image reference can be interpreted as a filesystem path without sufficient scheme validation or directory confinement
- Environmental dependency: The target process must have permission to access relevant paths, and image content must be compatible with the conversion behavior for direct disclosure
- Attack surface: OpenDocument file conversion through Docling's ODF backend
- Required access: Ability to submit or cause processing of a crafted document
- Trigger point: Resolution of an external or missing
draw:imagereference - Why exploitation is possible: The image reference can be interpreted as a filesystem path without sufficient scheme validation or directory confinement
- Environmental dependency: The target process must have permission to access relevant paths, and image content must be compatible with the conversion behavior for direct disclosure
Why this happens
The underlying bug is a failure to constrain attacker-controlled resource references before filesystem access. When an unresolved ODF image reference is passed to image-loading logic as a path, the backend can read outside the intended document archive and bypass controls used by other backends. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, because input-derived paths are not reliably confined to an approved directory or resource scheme.
The underlying bug is a failure to constrain attacker-controlled resource references before filesystem access. When an unresolved ODF image reference is passed to image-loading logic as a path, the backend can read outside the intended document archive and bypass controls used by other backends. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, because input-derived paths are not reliably confined to an approved directory or resource scheme.
Potential impact
- Sensitive local files may be embedded in converted documents
- The existence of files or directories may be inferred through processing behavior
- Application secrets, configuration data, or user content may be exposed if readable and decodable
- Confidentiality of the document-processing environment may be reduced
- Downstream systems may receive output containing unintended local data
- Sensitive local files may be embedded in converted documents
- The existence of files or directories may be inferred through processing behavior
- Application secrets, configuration data, or user content may be exposed if readable and decodable
- Confidentiality of the document-processing environment may be reduced
- Downstream systems may receive output containing unintended local data
General mitigation guidance
Mitigation generally focuses on treating document resource references as untrusted and enforcing a narrow resource policy before any filesystem operation.
Common defensive patterns include:
- Accepting only approved URI schemes and rejecting unexpected local-path references
- Confining extraction and resource access to a dedicated, canonicalized directory
- Applying the same local-fetch and access-control policy consistently across all document backends
- Validating resolved paths after canonicalization to prevent traversal and symlink escapes
- Running conversion workers with least-privilege filesystem permissions
- Using isolated temporary workspaces and limiting readable mounts
- Returning safe conversion errors rather than exposing path-dependent details
Mitigation generally focuses on treating document resource references as untrusted and enforcing a narrow resource policy before any filesystem operation.
Common defensive patterns include:
- Accepting only approved URI schemes and rejecting unexpected local-path references
- Confining extraction and resource access to a dedicated, canonicalized directory
- Applying the same local-fetch and access-control policy consistently across all document backends
- Validating resolved paths after canonicalization to prevent traversal and symlink escapes
- Running conversion workers with least-privilege filesystem permissions
- Using isolated temporary workspaces and limiting readable mounts
- Returning safe conversion errors rather than exposing path-dependent details
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis for filesystem APIs that receive values derived from document attributes
- Code review checks for missing scheme validation, canonicalization, and extraction-directory confinement
- Tests using absolute paths, traversal sequences, symlinks, and unresolved archive references
- Runtime monitoring for document workers reading outside approved workspaces
- Policy enforcement requiring local-resource access controls in every parser and backend
- Automated security review tools that flag untrusted path construction and file access
Organizations can identify similar issues through:
- Static analysis for filesystem APIs that receive values derived from document attributes
- Code review checks for missing scheme validation, canonicalization, and extraction-directory confinement
- Tests using absolute paths, traversal sequences, symlinks, and unresolved archive references
- Runtime monitoring for document workers reading outside approved workspaces
- Policy enforcement requiring local-resource access controls in every parser and backend
- Automated security review tools that flag untrusted path construction and file access
