Server-Side Request Forgery in LogicalDOC Community Edition
CVE-2026-109200

5.3MEDIUM

Key Information:

Vendor

Logicaldoc

Status
Logicaldoc Community Edition
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109200?

The LogicalDOC Community Edition up to version 9.3 has a server-side request forgery vulnerability in the XMLConverter component. This vulnerability allows authenticated users to upload XML documents containing stylesheets that point to untrusted resources, manipulating the server into fetching malicious content using attacker-controlled URLs. The default-enabled XMLConverter does not enforce scheme or host allowlisting for stylesheet href attributes, potentially leading to exploitation and unauthorized access to sensitive internal resources.

Affected Version(s)

LogicalDOC Community Edition 0 <= 9.3

References

https://github.com/logicaldoc/community/discussions/119
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicald...
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicald...
technical-description

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ikram-4
.