Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2025-45870: LogicalDOC Enterprise v9.1.1: Authenticated users can access sensitive files
CVE-2025-45870 · published 3 months ago
Summary
A vulnerability in LogicalDOC Enterprise, versions up to 9.1.1, allows authenticated users to access sensitive files they shouldn't be able to see. This is a serious issue because it could lead to unauthorized access to confidential information. To protect your system, update to the latest version of LogicalDOC Enterprise.
Original advisory text
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the file...
LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-22Path Traversal
Timeline
Published16 Jul 2026
Updated4 Nov 2026
First seen16 Jul 2026
Track software like this
Free during beta