CVE-2025-45870
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Local File Inclusion (LFI) vulnerability in LogicalDOC Enterprise up to and including version 9.1.1, present in the OnlyOfficeEditor servlet. Allows an authenticated user to exploit a path traversal flaw in the fileExt parameter to read files outside allowed directories.
Risk Assessment
Risk of unauthorized access to sensitive configuration files, user data, or other confidential system resources, potentially leading to information disclosure and attack escalation.
Recommendation
Immediately upgrade LogicalDOC Enterprise to a version newer than 9.1.1 that includes a fix for the LFI vulnerability. Until the update, restrict access to the OnlyOfficeEditor servlet to trusted users only.
Other vulnerabilities in LogicalDOC Enterprise
See all- CVE-2025-45868High
A vulnerability in LogicalDOC Enterprise up to version 9.1.1 allows an authenticated attacker to perform blind SQL injection in the ComparisonServlet component. Crafted input can be used to manipulate SQL queries.
- CVE-2025-45869High
LogicalDOC Enterprise versions up to 9.1.1 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.
Original NVD description (English source)
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories.