CVE-2026-109199
highLogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity…
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/logicaldoc/community disclosure@vulncheck.com
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logical... disclosure@vulncheck.com
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logic... disclosure@vulncheck.com
- https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00 disclosure@vulncheck.com
- https://github.com/logicaldoc/community/discussions/119 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injecti... disclosure@vulncheck.com