CVE-2026-109199
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
Risk Assessment
An authenticated attacker can execute arbitrary operating system commands with LogicalDOC process privileges, potentially leading to full server compromise. This poses a critical threat to confidentiality, integrity, and availability.
Recommendation
Upgrade LogicalDOC to a version newer than 9.3 if available, or restrict the ability to submit Velocity templates in email fields. Consider running LogicalDOC with minimal privileges and monitoring for unusual commands.
Other vulnerabilities in LogicalDOC Community Edition
See all- CVE-2017-1000022High
LogicalDoc Community Edition 7.5.3 and prior contain an incorrect access control which could lead to privilege escalation.
- CVE-2017-1000021High
LogicalDoc Community Edition version 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
- CVE-2026-109205High
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
- CVE-2026-109201High
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
- CVE-2025-12546Low
LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2025-11946Low
A security flaw was discovered in LogicalDOC Community Edition up to 9.2.1 affecting /frontend.jsp in the Add Contact Page component. Manipulation of First Name/Last Name/Company/Address/Phone/Mobile arguments results in cross site scripting, and the exploit has been publicly released.
Original NVD description (English source)
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS