LogicalDOC Enterprise is affected by multiple post-authentication directory traversal vulnerabilities that could allow an attacker to read sensitive system files.

The application fails to properly sanitize user-supplied input in the suffix and fileVersion parameters within the thumbnail and convertpdf endpoints. An attacker with authenticated access can leverage directory traversal sequences to bypass restricted directory limitations and retrieve arbitrary files from the underlying host server.

Successful exploitation of this vulnerability allows unauthorized access to sensitive configuration files, system credentials, or other private data stored on the server. This could lead to a complete compromise of the application environment or provide the necessary information for further lateral movement within the network. Given the CVSS score of 7.5, this is considered a high-risk vulnerability that requires prompt attention to protect organizational data integrity.

Immediate Action: Since no specific patch version is currently identified, administrators should contact LogicalDOC support to obtain the latest security updates or patches that resolve these path traversal flaws.

Proactive Monitoring: Review web server and application logs for suspicious GET requests targeting the thumbnail or convertpdf endpoints, specifically looking for path traversal sequences like dot-dot-slash patterns.

Compensating Controls: Deploy a Web Application Firewall with rules configured to detect and block directory traversal attempts, which can serve as an effective virtual patch while awaiting official vendor updates.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the Exploit-DB entry 44019.

Organizations utilizing LogicalDOC Enterprise must treat this vulnerability with high priority. Because the exploit mechanism is well documented and publicly available, the risk of exploitation by malicious actors is elevated. Security teams should restrict access to the affected endpoints to authorized users only, monitor for anomalous activity, and coordinate with the vendor to ensure the system is moved to a secure, updated version as soon as one becomes available.