CVE-2026-109200: LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated LogicalDOC Community Edition user who can upload an XML document can trigger the vulnerable conversion behavior. The issue affects Community Edition through version 9.3.
Is the vulnerable component enabled by default?
Yes. The XMLConverter is described as default-enabled, so deployments using the default configuration are exposed unless the component has been disabled or otherwise restricted.
What does an attacker need to provide?
The attacker needs to upload an XML document containing an xml-stylesheet href that points to a target URL. The converter can fetch http, ftp, file, or jar URLs and applies attacker-controlled XSLT during conversion.
What can be done if patching is not immediately possible?
Disable or restrict the default-enabled XMLConverter where operationally possible. Restricting access to XML upload and conversion functionality to trusted authenticated users can also reduce exposure.