---
id: CVE-2026-109200
title: >-
  LogicalDOC Community Edition through 9.3 contains a server-side request
  forgery vulnerability in the default-enabled XMLConverter that fetches
  xml-stylesheet href URLs without scheme or host allowlisting
summary: >-
  LogicalDOC Community Edition through 9.3 contains a server-side request
  forgery vulnerability in the default-enabled XMLConverter that fetches
  xml-stylesheet href URLs without scheme or host allowlisting. Authenticated
  users can upload X…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-918
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T14:17:10.527'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109200'
references:
  - url: 'https://github.com/logicaldoc/community'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249
    label: disclosure@vulncheck.com
  - url: 'https://github.com/logicaldoc/community/discussions/119'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.119Z'
---

## Overview

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.