CVE-2025-45869 identifies an SSRF vulnerability in LogicalDOC Enterprise versions prior to 9.1.1. The vulnerability arises from insufficient validation of input parameters in the ShareFileCallback servlet, enabling unauthenticated attackers to induce the server to send requests to arbitrary hosts controlled by the attacker. This could potentially be used to access internal resources or perform other unauthorized actions via the server. The vulnerability is publicly disclosed but lacks an assigned CVSS score and official remediation details.

An attacker can exploit this SSRF vulnerability without authentication to make the server perform requests to arbitrary external or internal hosts. This may lead to information disclosure or interaction with internal network services that are otherwise inaccessible. The exact impact depends on the server's network environment and configuration. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access from the LogicalDOC server to untrusted hosts and monitor for unusual outbound requests related to the ShareFileCallback servlet. Avoid exposing the vulnerable servlet to untrusted networks if possible.