CVEvulnerability
CVE-2026-109199
8.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-10-12
- Last modified
- 2026-10-18
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
Description
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://github.com/logicaldoc/community github.com
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java#L59 github.com
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java#L1543 github.com
- https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00 github.com
- https://github.com/logicaldoc/community/discussions/119 github.com
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injection-via-velocity-sendasemail-template www.vulncheck.com