# CVE-2026-109200: LogicalDOC Community Edition server-side request forgery in XMLConverter

Source: https://junglewise.ai/threats/cve-2026-109200-logicaldoc-community-edition-through-9-3-contains-a-server-side  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109200 · Severity: medium · CVSS 6.4 · Published 2026-10-12

LogicalDOC Community Edition is an open-source document management system. An authenticated user can upload XML documents with stylesheet references pointing to internal URLs (HTTP, FTP, file, or JAR), which the default XMLConverter will fetch and process without validation. This allows an attacker to access internal services, exfiltrate data, or inject malicious code into document conversions.

Technologies: [LogicalDOC Community Edition](https://junglewise.ai/threats/technologies/logicaldoc-community-edition). Vendors: [LogicalDOC](https://junglewise.ai/threats/vendors/logicaldoc).

## Quick answers

**Is CVE-2026-109200 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109200 being exploited in the wild.

**How severe is CVE-2026-109200?** Medium severity, with a CVSS score of 6.4, published 12 October 2026.

**Which products and versions are affected?** LogicalDOC Community Edition through 9.3.

**Is there a fix for CVE-2026-109200?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109200 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-109200?** Check whether you run LogicalDOC Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Server-side request forgery (SSRF) in the default-enabled XMLConverter component via xml-stylesheet href URLs. The vulnerability allows authenticated users to upload XML documents with stylesheet references pointing to internal resources (http, ftp, file, jar schemes) that the converter fetches without allowlisting; attackers can thus trigger server requests to internal services or apply attacker-controlled XSLT transformations during document conversion.

## Affected products

- LogicalDOC Community Edition through 9.3

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/logicaldoc/community](https://github.com/logicaldoc/community)
- [https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java](https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java)

## Related threats

- [LogicalDOC Community Edition username enumeration in AvatarServlet](https://junglewise.ai/threats/cve-2026-109206-logicaldoc-community-edition-through-9-3-contains-a-username)
- [LogicalDOC Community Edition unauthenticated file upload in UploadServlet](https://junglewise.ai/threats/cve-2026-109205-logicaldoc-community-edition-through-9-3-contains-an)
- [LogicalDOC Community Edition improper authorization in password recovery](https://junglewise.ai/threats/cve-2026-109204-logicaldoc-community-edition-through-9-3-contains-an-improper)
- [LogicalDOC Community Edition missing authorization in ConvertPdf servlet](https://junglewise.ai/threats/cve-2026-109203-logicaldoc-community-edition-through-9-3-contains-a-missing)
- [LogicalDOC Community missing authorization in zip-export servlet](https://junglewise.ai/threats/cve-2026-109202-logicaldoc-community-edition-through-9-3-contains-a-missing)