Medium · 5.4 CVE-2022-47418 EUVD-2022-50181GHSA-w58h-9w4c-p7rf

LogicalDOC Document Version Comment Stored XSS

Published Feb 7, 2023 · Updated Mar 25, 2025 · Assigned by rapid7

Vendor: LogicalDOC Product: LogicalDOC Community Edition Product: LogicalDOC Enterprise

Description

LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.

Affected products

Vendor	Product	Affected	Fixed
LogicalDOC	LogicalDOC Enterprise	≤ 8.8.2	—
LogicalDOC	LogicalDOC Community Edition	≤ 8.7.3	—

References

https://www.rapid7.com/blog/post/2023/02/07/multiple-dms-xss-cve-2022-47412-through-cve-20222-47419/ third-party-advisory