# CVE-2025-45869: LogicalDOC Enterprise SSRF in ShareFileCallback servlet

Source: https://junglewise.ai/threats/cve-2025-45869-logicaldoc-enterprise-ssrf-in-sharefilecallback-servlet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2025-45869 · Severity: info · CVSS 0 · Published 2026-07-13

LogicalDOC Enterprise, a document management system used by organizations to store and collaborate on files, is vulnerable to a security flaw in its ShareFile integration. An unauthenticated attacker can trick the server into sending sensitive connection credentials (OAuth client IDs and secrets) to a server they control. This could allow an attacker to gain unauthorized access to documents and data stored in the connected ShareFile account.

Technologies: [LogicalDOC Enterprise](https://junglewise.ai/threats/technologies/logicaldoc-enterprise). Vendors: [LogicalDOC](https://junglewise.ai/threats/vendors/logicaldoc).

## Quick answers

**Is CVE-2025-45869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-45869 being exploited in the wild.

**How severe is CVE-2025-45869?** Informational severity, with a CVSS score of 0, published 13 July 2026.

**Which products and versions are affected?** LogicalDOC Enterprise <= 9.1.1.

**Is there a fix for CVE-2025-45869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-45869 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-45869?** Check whether you run LogicalDOC Enterprise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthenticated SSRF exists in the ShareFileCallback servlet of LogicalDOC Enterprise (<= 9.1.1) due to insufficient validation of the 'apicp' and 'subdomain' parameters. An attacker can manipulate these parameters to redirect the server's outbound OAuth token request to an attacker-controlled host. During this request, the server transmits the configured ShareFile OAuth client_id and client_secret. Furthermore, because the 'state' parameter (used to identify users) is sequential, an attacker may be able to enumerate and exfiltrate credentials for multiple users. The vendor has indicated a fix will be available in version 9.2.

## Affected products

- LogicalDOC LogicalDOC Enterprise <= 9.1.1

## Timeline

- 2026-07-13: advisory: NVD publication date
- 2026-07-13: disclosed: Public disclosure of vulnerability details

## References

- [https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45869/README.md](https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45869/README.md)
- [https://www.logicaldoc.com/](https://www.logicaldoc.com/)

## Related threats

- [LogicalDOC Enterprise blind SQL injection in WorkflowsDataServlet](https://junglewise.ai/threats/cve-2025-45871-logicaldoc-enterprise-up-to-and-for-9-1-1-is-vulnerable-to-blind)
- [LogicalDOC Enterprise Local File Inclusion in OnlyOfficeEditor](https://junglewise.ai/threats/cve-2025-45870-logicaldoc-enterprise-local-file-inclusion-in-onlyofficeeditor)
- [LogicalDOC Enterprise blind SQL injection in ComparisonServlet](https://junglewise.ai/threats/cve-2025-45868-logicaldoc-enterprise-blind-sql-injection-in-comparisonservlet)