CVE-2025-12546: LogicalDOC Community Edition XSS Vulnerability

CVE-2025-12546 Overview

CVE-2025-12546 is a cross-site scripting (XSS) vulnerability [CWE-79] affecting LogicalDOC Community Edition up to version 9.2.1. The flaw resides in the API Key creation user interface, where insufficient input sanitization allows attackers to inject malicious script content. Remote exploitation is possible over the network, though it requires authenticated access with low privileges and user interaction to trigger. The exploit has been publicly disclosed and may be leveraged by attackers. The vendor was contacted about the disclosure but did not respond.

Critical Impact
Authenticated attackers can inject persistent JavaScript through the API Key creation UI, enabling session-based attacks against LogicalDOC users who view the affected component.

Affected Products

LogicalDOC Community Edition versions up to and including 9.2.1
Deployments exposing the API Key management interface
Multi-user LogicalDOC instances where accounts share document workspaces

Discovery Timeline

2025-10-31 - CVE-2025-12546 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12546

Vulnerability Analysis

The vulnerability affects the API Key creation UI within LogicalDOC Community Edition, a document management platform. When a user creates or manages API keys, input fields fail to properly encode or sanitize user-supplied content before rendering it in the browser. This allows an authenticated attacker to inject arbitrary HTML or JavaScript into stored fields, which executes in the context of any user viewing the affected view.

Exploitation requires an existing low-privilege account and interaction from a victim user, which limits mass exploitation. However, the impact scales in shared multi-tenant deployments where administrators may routinely inspect API key entries created by other users. Successful execution runs script code in the victim's session context, enabling theft of session tokens, forced actions via authenticated requests, or UI manipulation.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The API Key creation UI accepts user-controlled input without applying output encoding when rendering that input back into the DOM. Because the payload is stored in application state and reflected on subsequent views, this behaves as a stored XSS condition rather than a purely reflected one.

Attack Vector

An attacker with valid credentials navigates to the API Key creation interface and submits a crafted payload containing JavaScript within a field that is later rendered without escaping. When another authenticated user opens the affected view, the injected script executes with that user's privileges. Refer to the GitHub Gist proof-of-concept and the VulDB entry #330806 for the disclosed technical details.

Detection Methods for CVE-2025-12546

Indicators of Compromise

API Key records containing HTML tags such as <script>, <img>, <svg>, or event handler attributes like onerror= and onload=
Unexpected outbound HTTP requests from browsers of authenticated LogicalDOC users to attacker-controlled domains
Session tokens or cookies observed in web server logs of unrelated external hosts referenced from LogicalDOC page loads

Detection Strategies

Inspect the LogicalDOC database tables backing API key metadata for stored values containing angle brackets or JavaScript URI schemes
Enable and review Content Security Policy (CSP) violation reports to identify script execution attempts blocked by browser policy
Correlate low-privilege account activity with visits to /api-keys or equivalent management endpoints followed by administrative user page views

Monitoring Recommendations

Log all create, update, and delete operations on API key entities with the submitting user identity and full request body
Alert on anomalous DOM behavior or script execution originating from the LogicalDOC origin using browser telemetry where available
Monitor authentication and session activity for concurrent logins or unexpected privilege elevation following API key modifications

How to Mitigate CVE-2025-12546

Immediate Actions Required

Restrict access to the LogicalDOC application to trusted users only until a vendor patch is available, given the unresponsive vendor status
Audit existing API key records for injected HTML or JavaScript content and remove any suspicious entries
Enforce strong role separation so that low-privilege users cannot create records that administrators must review in the browser

Patch Information

No vendor patch has been published at the time of writing. The vendor was contacted about the disclosure but did not respond, and no fixed version has been announced for LogicalDOC Community Edition. Monitor the VulDB advisory and the official LogicalDOC release notes for future updates.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Place LogicalDOC behind a web application firewall (WAF) with rules that block common XSS payload patterns targeting the API key endpoints
Disable or limit the API key creation feature for non-administrative accounts through role configuration
Educate administrators to avoid opening API key entries created by untrusted users until the issue is remediated

bash

# Example nginx CSP header to mitigate stored XSS execution
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;