CVE WatchJul 16, 2026

CVE-2025-45870

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authe

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

0-100

Published: Jul 16, 2026 · Last modified: Jul 16, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories.

Official references

github.comhttps://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45870/README.md
www.logicaldoc.comhttps://www.logicaldoc.com/

Related CVEs

No related CVEs by CWE or product.