CVE-2026-109205
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
Risk Assessment
An attacker can fill the server disk, leading to service failure and potential data loss. The unauthenticated nature of the attack means anyone can carry it out.
Recommendation
Upgrade LogicalDOC to a version newer than 9.3 if available, or restrict access to /upload and enforce size and file count limits. Regularly clean temporary directories and monitor disk usage.
Other vulnerabilities in LogicalDOC Community Edition
See all- CVE-2017-1000022High
LogicalDoc Community Edition 7.5.3 and prior contain an incorrect access control which could lead to privilege escalation.
- CVE-2017-1000021High
LogicalDoc Community Edition version 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
- CVE-2026-109201High
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
- CVE-2026-109199High
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
- CVE-2025-12546Low
LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.
- CVE-2025-11946Low
A security flaw was discovered in LogicalDOC Community Edition up to 9.2.1 affecting /frontend.jsp in the Add Contact Page component. Manipulation of First Name/Last Name/Company/Address/Phone/Mobile arguments results in cross site scripting, and the exploit has been publicly released.
Original NVD description (English source)
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS