Medium severity · published Oct 12, 2026
CVE-2026-109200
LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
LogicalDOC Community Edition · LogicalDOC
through 9.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109200
technical-description
https://github.com/logicaldoc/community/discussions/119
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106
product
https://github.com/logicaldoc/community
third-party-advisory
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href
More from LogicalDOC Community Edition
8.8
CVE-2026-109199
LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template
8.3
CVE-2026-109201
LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
7.5
CVE-2026-109205
LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
6.5
CVE-2026-109203
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
6.5
CVE-2026-109202
LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet