| Package | Affected versions | Patched versions |
|---|---|---|
| logicaldoc | = 7.1.1= 7.4.2= 7.5.1= 7.6.2= 7.6.4= 7.7.1= 7.7.2= 7.7.3= 7.7.4 |
LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'fileVersion' parameters. Attackers can exploit directory traversal techniques in /thumbnail and /convertpdf endpoints to access sensitive system files like win.ini and /etc/passwd by manipulating path traversal sequences.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free