https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:03:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338564 EUVD-2026-338564 https://cve.radiocsirt.org/vuln/euvd-2026-338564 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44023 <p>Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.</p> <p>Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44023 https://cve.radiocsirt.org/vuln/ghsa-jmmv-h3mp-59v8 <p><strong>Affected:</strong> PyPI: docling-core</p> <p>### Impact In versions `&gt;= 1.5.0, &lt; 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.</p> <p>In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.</p> <p>### Patches Patched in `docling-core` `2.74.1`. The fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.</p> <p>Users should upgrade to: - `docling-core` `&gt;= 2.74.1`</p> <p>### Workarounds If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.</p> <p>### References - Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)</p> <p><strong>Affected:</strong> PyPI: docling-core</p> <p>### Impact In versions `&gt;= 1.5.0, &lt; 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.</p> <p>In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.</p> <p>### Patches Patched in `docling-core` `2.74.1`. The fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.</p> <p>Users should upgrade to: - `docling-core` `&gt;= 2.74.1`</p> <p>### Workarounds If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.</p> <p>### References - Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)</p> https://cve.radiocsirt.org/vuln/ghsa-jmmv-h3mp-59v8 https://cve.radiocsirt.org/vuln/pysec-2026-2457 <p><strong>Affected:</strong> PyPI: docling-core</p> <p>### Impact In versions `&gt;= 1.5.0, &lt; 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.</p> <p>In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.</p> <p>### Patches Patched in `docling-core` `2.74.1`. The fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.</p> <p>Users should upgrade to: - `docling-core` `&gt;= 2.74.1`</p> <p>### Workarounds If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.</p> <p>### References - Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)</p> <p><strong>Affected:</strong> PyPI: docling-core</p> <p>### Impact In versions `&gt;= 1.5.0, &lt; 2.74.1`, `docling-core` did not sufficiently restrict remote request destinations and could resolve a server-provided `Content-Disposition` to a local path in an unsafe manner.</p> <p>In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory.</p> <p>### Patches Patched in `docling-core` `2.74.1`. The fix adds stricter validation for remote destinations and normalizes server-provided filenames before use.</p> <p>Users should upgrade to: - `docling-core` `&gt;= 2.74.1`</p> <p>### Workarounds If upgrading is not immediately possible, avoid passing untrusted URLs into remote fetch functionality.</p> <p>### References - Fix release: [`v2.74.1`](https://github.com/docling-project/docling-core/releases/tag/v2.74.1)</p> https://cve.radiocsirt.org/vuln/pysec-2026-2457