LogicalDOC Community Edition up to 9.3 contains a server‑side request forgery flaw in the XMLConverter component. The converter accepts xml‑stylesheet href attributes that lack scheme or host allowlisting, enabling authenticated users to upload XML documents that cause the server to fetch internal URLs over HTTP, FTP, FILE, or JAR. The fetched XSLT is applied during conversion, giving the attacker control over the transformation logic and potentially exposing internal resources or executing arbitrary instructions. This flaw is classified as CWE‑918.

The vulnerability affects LogicalDOC Community Edition versions 9.0 through 9.3. Administrators should verify the installed version and note that any deployment of a version preceding—or including—9.3 is susceptible until a patch is applied.

The public CVSS score is 5.3, indicating a moderate severity. EPSS data is not available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting that it has not yet been actively leveraged in the wild. Exploitation requires an authenticated account, so the risk is confined to systems that expose upload functionality to legitimate users. If an attacker can influence XSLT content, they may gain access to internal network services or data exposed by the server‑side request.