What is GHSA-c3rf-pmgq-wq29?

GHSA-c3rf-pmgq-wq29 is a security advisory published by GitHub Security Advisories with Medium severity. LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the...

Which CVE IDs does GHSA-c3rf-pmgq-wq29 cover?

GHSA-c3rf-pmgq-wq29 covers the following CVE IDs: CVE-2025-45870. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c3rf-pmgq-wq29?

GHSA-c3rf-pmgq-wq29 has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-c3rf-pmgq-wq29MediumCVSS 6.5

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the...

Vendor

GitHub Security Advisories

Published

July 16, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2025-45870 →

📋 Description

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion (LFI) in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-45870
https://github.com/netero1010/Vulnerability-Disclosure/blob/main/CVE-2025-45870/README.md
https://www.logicaldoc.com
https://github.com/advisories/GHSA-c3rf-pmgq-wq29