Medium · 5.4 CVE-2022-47417 EUVD-2022-50180GHSA-mw5v-q85w-g5pq

LogicalDOC Document File Name Stored XSS

Published Feb 7, 2023 · Updated Mar 25, 2025 · Assigned by rapid7

Vendor: LogicalDOC Product: LogicalDOC Community Edition Product: LogicalDOC Enterprise

Description

LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document file name.

Affected products

Vendor	Product	Affected	Fixed
LogicalDOC	LogicalDOC Enterprise	≤ 8.8.2	—
LogicalDOC	LogicalDOC Community Edition	≤ 8.7.3	—

References

https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ third-party-advisory