CVE-2026-109200: Server-Side Request Forgery (SSRF) in LogicalDOC LogicalDOC Community Edition

CVE-2026-109200 is a server-side request forgery vulnerability affecting LogicalDOC Community Edition through version 9.3. The vulnerability exists in the XMLConverter feature, which is enabled by default and fetches xml-stylesheet href URLs without validating or allowlisting the scheme or host. Authenticated attackers can exploit this by uploading XML documents whose stylesheet href references internal resources via various protocols (http, ftp, file, jar), causing the server to perform unauthorized requests and apply attacker-controlled XSL transformations during the conversion process.

An authenticated user can leverage this vulnerability to force the server to make requests to internal or otherwise restricted resources, potentially exposing sensitive internal information or enabling further attacks through the application of attacker-controlled XSLT. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting the XMLConverter feature or implementing strict allowlisting for xml-stylesheet href URLs to prevent SSRF exploitation.