LogicalDOC Community Edition CVE-2026-109169

Requires an authenticated session with at least a low-privileged LogicalDOC account (PR:L) that can reach TagsDataServlet; the injection point is the firstLetter parameter, which in versions through 9.3 is concatenated directly into a LIKE clause in HibernateDocumentDAO.findTags rather than parameterized. No user interaction and no special non-default configuration is needed beyond normal multi-user operation. The authentication requirement is the primary limiting factor - exploitation is not possible by a fully unauthenticated remote attacker - and impact is limited to data disclosure (read access to ld_user), with no direct write/integrity or availability effect.

This is a credible but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and CWE-89 are internally consistent with the description: network-reachable, low-complexity, authenticated (PR:L) SQL injection with no user interaction, impacting confidentiality only (VC:H, VI:N/VA:N). The 7.1 score is driven entirely by data disclosure - specifically the ability to dump usernames, emails and password hashes from the ld_user table via UNION SELECT, which creates clear follow-on risk (offline hash cracking, lateral authentication). Mitigating factors lower real-world urgency: exploitation requires a valid low-privileged account (PR:L), a vendor patch exists, and there is no EPSS score, no CISA KEV listing, and no explicitly published exploit in the provided data. The source-code diff from the vendor confirms the root cause (unparameterized string formatting of firstLetter into a LIKE clause, fixed by binding :tagLike), so the vulnerability itself is well-substantiated even though exploitation-probability signals (EPSS) are entirely absent and should be treated as unknown rather than low. Net: a real, patch-now priority for exposed multi-user deployments, but not a mass-exploitation emergency given the authentication requirement and niche product footprint.

A low-privileged authenticated user (or an attacker who has obtained any valid LogicalDOC account) issues a request to TagsDataServlet with a crafted firstLetter value containing a UNION SELECT, causing the injected query to return rows from ld_user inside the XML tag list. The attacker reads usernames, email addresses and password hashes directly from the response, then cracks the hashes offline to escalate to higher-privileged accounts. No public exploit is identified in the provided data, but the vendor commit diff clearly discloses the vulnerable code path.