🟠 《高危安全漏洞：CVE-2026-44023》

CVSS 评分: 高危（8.6）　　状态: Received　　发布时间: 2026-07-16

漏洞描述

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in an unsafe manner. In applications that accept untrusted URLs, this could allow SSRF attacks targeting local files outside the user-defined cache directory. This issue has been fixed in version 2.74.1.

🔍 技术细节

字段 值
CVE ID CVE-2026-44023
CVSS 评分 8.6 🟠
严重程度 高危
CVSS 向量 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CWE 分类 CWE-22,CWE-918
发布时间 2026-07-16
最后更新 2026-07-16
状态 Received
数据来源 security-advisories@github.com

🔗 参考链接