LogicalDOC Enterprise 7.7.4 Mehrere Post-Authentifizierungs-Directory-Traversal-Schwachstellen

Successful exploitation of CVE-2019-25258 allows an attacker to bypass access controls and read sensitive system files. By crafting malicious requests with manipulated suffix and fileVersion parameters, an attacker can leverage directory traversal sequences to access files outside of the intended scope. This could include critical configuration files like win.ini (on Windows systems) or /etc/passwd (on Linux systems), potentially revealing usernames, passwords, and other sensitive information. The potential for data exfiltration and system compromise is significant.

Organizations utilizing LogicalDOC Enterprise for document management, particularly those with older versions (7.1.1 – 7.7.4), are at risk. Shared hosting environments where multiple users have access to the LogicalDOC Enterprise instance are also particularly vulnerable, as a compromised user account could be leveraged to exploit this vulnerability.

• windows / other: Monitor event logs for unusual file access attempts, particularly targeting files outside of the LogicalDOC Enterprise application directory. Use Sysinternals Process Monitor to observe file system activity related to the LogicalDOC Enterprise process. • linux / server: Examine auditd logs for attempts to access files outside the expected directories. Use lsof to identify processes accessing sensitive system files. • generic web: Inspect access logs for requests to /thumbnail and /convertpdf endpoints with unusual or excessively long parameters. Look for patterns indicative of path traversal attempts.

1. 2025-12-24Disclosure

   disclosure

1. Reserviert2025-12-24
2. Veröffentlicht2025-12-24
3. Geändert2026-03-05
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2019-25258 is to upgrade LogicalDOC Enterprise to version 7.7.5 or later, which contains the necessary fix. If an immediate upgrade is not possible, consider implementing temporary workarounds such as restricting access to the /thumbnail and /convertpdf endpoints to trusted users only. Network segmentation can also limit the blast radius. Monitor access logs for unusual file access patterns, particularly attempts to access files outside of the expected directories. After upgrading, confirm the fix by attempting to access sensitive files using the vulnerable parameters; access should be denied.