CVE-2026-109200

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109200

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109200.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109200

Published

2026-10-12T13:39:43Z

Modified

2026-10-15T02:31:15Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href

Details

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109200.json"
}

References

Affected packages

Git / github.com/logicaldoc/community

Affected ranges

Type

GIT

Repo

https://github.com/logicaldoc/community

Events

Introduced

Fixed

ab9fa93090869e6f3a77f2e9b0704e5381ae56ff

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "9.3"
        },
        {
            "fixed":  "9.3"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

8.*

8.0

8.4.2

8.5.2

8.6.1

8.7.3

8.8.2

8.8.4

8.8.5

8.9

8.9.1

8.9.2

8.9.3

9.*

9.0

9.1

9.1.1

9.2

9.2.1

9.2.2

9.2.3

Other

before-jakarta-porting

v8.*

v8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109200.json"