CVE-2026-109200: LogicalDOC Community Edition through 9.3 SSRF via XMLConverter xml-stylesheet href

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-15
Weakness: CWE-918

Description

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.

Affected products

LogicalDOC Community Edition: through 9.3

References

https://github.com/logicaldoc/community
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249
https://github.com/logicaldoc/community/discussions/119
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href

Get alerted when CVE-2026-109200 or the next vulnerability affects your stack