Description

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-10-12T14:17:10.527Z",
  "pubdate": "2026-10-12T14:17:10.527Z",
  "executiveSummary": "LogicalDOC Community Edition up to version 9.3 is susceptible to a Server-Side Request Forgery (SSRF) vulnerability residing within the XMLConverter component. This flaw arises from the improper processing of XML documents that contain external references within 'xml-stylesheet' processing instructions.\nThe vulnerability allows an authenticated attacker to force the server to initiate arbitrary outbound requests to internal or external resources using protocols such as http, ftp, file, or jar. By manipulating the stylesheet href attribute, an attacker can influence the server-side XML transformation process, potentially leading to unauthorized data exfiltration, internal network reconnaissance, or arbitrary XSLT execution.\nThis vulnerability is particularly critical due to the absence of scheme or host allowlisting, which grants the attacker significant control over the server's network interactions. Exploitation requires valid authentication within the application, but once authenticated, an attacker can leverage the XML processing engine to interact with assets otherwise protected by the internal network perimeter. The risk includes the compromise of sensitive internal data and the potential for leveraging the server as a pivot point for broader attacks within the infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is the insecure configuration of the XMLConverter component in LogicalDOC Community Edition versions through 9.3. Specifically, the application parses user-uploaded XML files and processes 'xml-stylesheet' processing instructions without enforcing restrictive security policies on the associated URI references.\nIn a standard XML parsing workflow, the 'xml-stylesheet' instruction is used to associate an XSLT document with an XML document to define transformation rules. Because the XMLConverter fails to validate the protocol or the destination host of the href attribute, the underlying XML parser is permitted to resolve resources from arbitrary locations. This allows the specification of non-standard or dangerous schemes, such as 'file://' to read local filesystem contents, 'jar://' to access compressed archive contents, or 'ftp://' and 'http://' to perform internal port scanning or fetch malicious payloads.\nThe exploitation flow proceeds as follows: First, the attacker crafts a malicious XML document containing a crafted 'xml-stylesheet' instruction. The href attribute is set to an attacker-controlled URL or a sensitive internal target (e.g., 'http://127.0.0.1:8080' or 'file:///etc/passwd'). Second, the attacker uploads this document via the application's file ingestion functionality. Third, the XMLConverter component is triggered to process the uploaded file, at which point it initiates a backend request to the provided URI.\nWhen the server processes the stylesheet, it applies the attacker-supplied XSLT (if hosted externally) or performs a server-side include of internal resources. If an attacker provides a URL pointing to an XSLT document, the parser will execute the instructions contained within that XSLT, which may include functions to read local files or further interact with the server's environment. This transformation process happens with the privileges of the application service account, meaning the server becomes an agent for the attacker to interact with the local operating system and the intranet. The lack of an allowlist essentially converts a document processing feature into an unrestricted request-making service, enabling full-read access to server-reachable network resources."
}