Local File Inclusion in LogicalDOC Enterprise

Executive Summary

CVE-2025-45870 is a Local File Inclusion (LFI) vulnerability in LogicalDOC Enterprise versions up to 9.1.1. It exists in the OnlyOfficeEditor servlet, specifically the /onlyoffice/editor endpoint. An authenticated user can exploit path traversal flaws in the fileExt parameter by using sequences like '../' to access files outside the intended directory. The vulnerability occurs because user input is passed to the OnlyOfficeDocumentManager.createSample method without proper validation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if LogicalDOC Enterprise versions up to 9.1.1 are running. Inspect network traffic for requests to the /onlyoffice/editor endpoint with manipulated fileExt parameters containing path traversal sequences like ../. Review server logs for unusual file access patterns or sample document creation events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to read sensitive files on the server, including configuration files that may contain secrets or credentials. If exploited, it could lead to unauthorized access to internal infrastructure details, potentially facilitating further compromise of the system or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive files. Exposure of configuration files or credentials may violate data protection requirements under GDPR (e.g., unauthorized access to personal data) and HIPAA (e.g., breach of protected health information).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to LogicalDOC version 9.2 or later if available. As a temporary measure, restrict access to the /onlyoffice/editor endpoint and implement strict allowlisting for the fileExt parameter. Reject any input containing path traversal sequences and enforce canonical path resolution within intended directories.

Useful 0 Not Useful 0