CVE-2019-25258: Logicaldoc

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.

Affected products

• Logicaldoc Logicaldoc: version 7.1.1 only; version 7.4.2 only; version 7.5.1 only; version 7.6.2 only; version 7.6.4 only; version 7.7.1 only; …

Published 2025-12-24. Last modified 2026-06-17.