Local File Inclusion Vulnerability in LogicalDOC Enterprise by LogicalDOC
CVE-2025-45870

6.5MEDIUM

Key Information:

Vendor

LogicalDOC

Status
LogicalDOC Enterprise
Vendor
CVE Published:
16 July 2026

What is CVE-2025-45870?

LogicalDOC Enterprise versions up to and including 9.1.1 are susceptible to a Local File Inclusion vulnerability within the OnlyOfficeEditor servlet. This flaw allows authenticated users to exploit weaknesses related to path traversal in the 'fileExt' parameter, leading to unauthorized access to sensitive files located beyond the intended directories. Organizations using these versions should take immediate action to assess their exposure and implement necessary security measures.

References

https://www.logicaldoc.com/
https://github.com/netero1010/Vulnerability-Disclosure/bl...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.