P4Verified

CVE-2026-109200: LogicalDOC Community Edition 0 through 9.3

CVE-2026-109200. CVSS 3.1 base score 6.4 (GitHub Advisory Database).

Affected technology

LogicalDOC Community Edition · 0 through 9.3
LogicalDOC

Description’s affected range: through 9.3

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and integrity impact as low; availability impact as none.

Published 12-Oct-2026 16:55 UTC

CWE: CWE-918
CCR priority: 25.6 /100 (P4)
CVSS 3.1: 6.4 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · GitHub Advisory Database
KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-12 16:57:19.354142+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-12 16:54:24.294989+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-109200.html