What’s Vulnerable › Vulnerabilities

CVE-2019-25258: LogicalDOC Enterprise 7.7.4 Multiple Post-Authentication Directory Traversal Vulnerabilities

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-24 · updated 2026-06-17
• Weakness: CWE-22

Description

LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.

Affected products

• LogicalDOC Enterprise: 7.1.1, 7.4.2, 7.5.1, 7.6.2, 7.6.4, 7.7.1 (+3)

References

• https://www.exploit-db.com/exploits/44019
• https://www.logicaldoc.com
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.php
• https://www.exploit-db.com/exploits/44019
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5450.php

Get alerted when CVE-2019-25258 or the next vulnerability affects your stack