CVE-2025-45869 identifies a Server-Side Request Forgery (SSRF) vulnerability in LogicalDOC Enterprise versions before 9.1.1. The issue resides in the ShareFileCallback servlet, which improperly validates input parameters, enabling unauthenticated attackers to induce the server to send requests to arbitrary hosts under attacker control. This can lead to information disclosure, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: Low, Integrity: Low, Availability: Low). No vendor advisory or patch information is available at this time.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform requests to arbitrary external or internal systems. This may result in limited confidentiality, integrity, and availability impacts, such as accessing internal resources or causing unintended server behavior. The CVSS score of 7.3 reflects a high severity due to the network attack vector and lack of required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting network access from the affected server to untrusted hosts and monitoring for unusual outbound requests targeting attacker-controlled domains. Avoid exposing the vulnerable servlet to untrusted networks if possible.