LogicalDOC Enterprise vulnerabilities
3 known CVE vulnerabilities in LogicalDOC Enterprise, translated and rated.
- CVE-2025-45870Medium
Local File Inclusion (LFI) vulnerability in LogicalDOC Enterprise up to and including version 9.1.1, present in the OnlyOfficeEditor servlet. Allows an authenticated user to exploit a path traversal flaw in the fileExt parameter to read files outside allowed directories.
- CVE-2025-45868High
A vulnerability in LogicalDOC Enterprise up to version 9.1.1 allows an authenticated attacker to perform blind SQL injection in the ComparisonServlet component. Crafted input can be used to manipulate SQL queries.
- CVE-2025-45869High
LogicalDOC Enterprise versions up to 9.1.1 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.