---
id: CVE-2026-109200
title: >-
  LogicalDOC Community Edition through 9.3 contains a server-side request
  forgery vulnerability in the default-enabled XMLConverter that fetches
  xml-stylesheet href URLs without scheme or host allowlisting
summary: >-
  LogicalDOC Community Edition through 9.3 contains a server-side request
  forgery vulnerability in the default-enabled XMLConverter that fetches
  xml-stylesheet href URLs without scheme or host allowlisting. Authenticated
  users can upload X…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-918
vendor: LogicalDOC
product: LogicalDOC Community Edition
affected:
  - community_edition <= 9.3
published: '2026-10-12'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T03:17:06.807'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109200'
references:
  - url: 'https://github.com/logicaldoc/community'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249
    label: disclosure@vulncheck.com
  - url: 'https://github.com/logicaldoc/community/discussions/119'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00177
epssPercentile: 0.07234
ingestedAt: '2026-10-12T14:50:34.119Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-14T17:48:27.110477Z'
---

## Overview

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.