Executive brief
LogicalDOC Enterprise, a document management system used by organizations to store and collaborate on files, is vulnerable to a security flaw in its OnlyOffice integration. An authenticated user can exploit this flaw to access sensitive files on the server that they should not be able to see, such as configuration files containing credentials or system secrets. This could lead to a broader breach of the organization's internal infrastructure and data.
Technical details
A Local File Inclusion (LFI) vulnerability exists in the OnlyOfficeEditor servlet class within LogicalDOC Enterprise versions up to and including 9.1.1. The vulnerability is located in the `/onlyoffice/editor` endpoint, specifically within the `OnlyOfficeDocumentManager.createSample` method. An authenticated attacker can provide path traversal sequences (e.g., ../) in the `fileExt` parameter. Because the application fails to validate or normalize this input, it reads the specified file from the server's local file system and imports it as a 'sample document' into the document management interface. From there, the attacker can download and view the contents of sensitive files, such as configuration files or system secrets, accessible to the LogicalDOC server process. The vendor has indicated a fix will be available in version 9.2.
Affected products
- LogicalDOC LogicalDOC Enterprise <= 9.1.1
Timeline
- 2026-07-16: disclosed: CVE-2025-45870 published
- 2026-07-16: advisory