---
id: CVE-2025-45869
title: >-
  LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to
  Server-Side Request Forgery (SSRF)
summary: >-
  LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to
  Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit
  the ShareFileCallback servlet by manipulating input parameters to trigger a
  server-side re…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-918
published: '2026-07-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-45869'
references:
  - url: >-
      https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45869/README.md
    label: cve@mitre.org
  - url: 'https://www.logicaldoc.com/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00338
epssPercentile: 0.25346
ingestedAt: '2026-10-13T09:20:23.173Z'
---

## Overview

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.