Medium · 5.4 CVE-2022-47415 EUVD-2022-50178GHSA-5cxj-h7vw-5448

LogicalDOC Messaging Stored XSS

Published Feb 7, 2023 · Updated Mar 25, 2025 · Assigned by rapid7

Vendor: LogicalDOC Product: LogicalDOC Community Edition Product: LogicalDOC Enterprise

Description

LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).

Affected products

Vendor	Product	Affected	Fixed
LogicalDOC	LogicalDOC Enterprise	≤ 8.8.2	—
LogicalDOC	LogicalDOC Community Edition	≤ 8.7.3	—

References

https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ third-party-advisory