CVE-2026-109200
6.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-918
Impact
Authenticated users can trigger server-side request forgery to internal services and force execution of attacker-controlled XSLT during document conversion. They need valid credentials to upload crafted XML files containing external stylesheet references.
Root cause
The XMLConverter resolves and fetches xml-stylesheet href targets without validating schemes or host allowlists, permitting arbitrary protocols like file, jar, ftp, and http.
Affected systems
LogicalDOC Community Edition through 9.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
No fixed release is documented yet; restrict XML upload permissions for untrusted accounts or disable the XMLConverter component in the processing configuration if possible.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
References
- https://github.com/logicaldoc/community
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249
- https://github.com/logicaldoc/community/discussions/119
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href