What is the CVSS score of CVE-2025-45869?

CVE-2025-45869 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of LogicalDOC are affected by CVE-2025-45869?

LogicalDOC Enterprise versions 9.1.1 and earlier contain a Server-Side Request Forgery vulnerability in the ShareFileCallback servlet that allows unauthenticated remote attackers to manipulate the…

How to fix or mitigate CVE-2025-45869?

Within 24 hours, immediately inventory all LogicalDOC Enterprise deployments and identify instances running version 9.1.1 or earlier; restrict network access to the ShareFileCallback servlet endpoint (/logicaldoc/frontend/servlet/ShareFileCallback) to authorized users only and enable detailed logging for all requests to this endpoint. Within 7 days, implement Web Application Firewall (WAF) rules to block suspicious request patterns to ShareFileCallback, enable network segmentation to restrict outbound HTTP/HTTPS connections from LogicalDOC servers to internal networks and cloud metadata services (e.g., 169.254.169.254), and begin testing available patches or upgrade paths to versions beyond 9.1.1 if released by vendor. Within 30 days, complete a comprehensive network audit to identify any internal reconnaissance that may have occurred, deploy endpoint detection and response (EDR) monitoring on systems that interact with affected LogicalDOC instances, and establish a formal timeline for migration to patched versions or alternative document management solutions if vendor patches remain unavailable.

LogicalDOC CVE-2025-45869

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-13 mitre

SSRF N A

7.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Unauthenticated, network-reachable servlet with no user interaction gives AV:N/AC:L/PR:N/UI:N; SSRF yields limited confidentiality plus possible internal request effects, so C:L/I:L/A:L, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:20 vuln.today

CVSS changed

Jul 13, 2026 - 20:22 NVD

7.3 (HIGH)

CVE Published

Jul 13, 2026 - 00:00 cve.org

HIGH 7.3

CVE Published

Jul 13, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.

AnalysisAI

Server-Side Request Forgery in LogicalDOC Enterprise versions up to and including 9.1.1 lets a remote, unauthenticated attacker abuse the ShareFileCallback servlet to coerce the server into issuing HTTP requests to an attacker-chosen host. Because no credentials are required and the flaw is network-reachable, it can be used to probe internal networks, reach otherwise-firewalled services, and potentially retrieve cloud metadata. A public technical disclosure exists (netero1010 Vulnerability-Disclosure repository); there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.

Technical ContextAI

LogicalDOC is a Java servlet-based enterprise document management system (DMS). The vulnerable component is the ShareFileCallback servlet, an endpoint whose input parameters are used to construct an outbound server-side request. This is a textbook CWE-918 (Server-Side Request Forgery) condition: user-controllable input flows into a URL/host used by the server's own HTTP client without adequate validation or allow-listing, so the server acts as a proxy on behalf of the attacker. The callback design (typically used to fetch or acknowledge shared-file resources) makes it a natural SSRF sink because it is expected to reach out to external or internal endpoints.

RemediationAI

Upgrade LogicalDOC Enterprise to a fixed release after 9.1.1 - the disclosure indicates 9.1.1 and earlier are vulnerable, so move to the next vendor-patched version; confirm the exact fixed build directly with LogicalDOC (https://www.logicaldoc.com/) as no specific patched version number was provided in the input data. Until patched, restrict reachability of the ShareFileCallback servlet by placing the application behind a reverse proxy or WAF rule that blocks requests to that endpoint from untrusted networks, and apply egress filtering so the LogicalDOC server cannot make outbound connections to internal ranges (RFC1918), link-local 169.254.169.254 cloud-metadata addresses, or arbitrary external hosts - allow-list only the outbound destinations the application legitimately needs. Trade-offs: egress restrictions may break legitimate external file-share callbacks or integrations, and blocking the servlet outright may disable file-sharing callback functionality, so validate against business workflows before enforcing. Review the disclosure at https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45869/README.md for exploit specifics.