Technical impact
LogicalDOC Enterprise software is vulnerable to a local file inclusion flaw, CWE-22: Path Traversal, within the OnlyOfficeEditor servlet. The fileExt request parameter can be manipulated by an authenticated user, allowing the reading of files outside the intended directories. This flaw can expose confidential documents or system configuration files, compromising data confidentiality and potentially system integrity if tampered files are later executed.
Affected Systems
LogicalDOC Enterprise versions up to and including 9.1.1 are affected. Only the OnlyOfficeEditor component is impacted, and no other vendors or products are presently known to be impacted.
Risk and Exploitability
The CVSS v3.1 score is 6.5, indicating medium severity. The EPSS score is less than 1 %, pointing to a very low but non‑zero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication to the OnlyOfficeEditor servlet; once authenticated, an attacker can craft fileExt values to read arbitrary files located outside the intended workspace.
