LogicalDOC Community Edition CVE-2026-109199

Exploitation requires an authenticated LogicalDOC Community Edition account (through version 9.3) that can access the DocumentService.sendAsEmail function; the attacker supplies a Velocity template expression in the email subject or message field, which the server evaluates server-side. The payload must call SystemTool exec methods or ClassTool to reach OS command execution, deliberately bypassing the forbidRuntimeUsage denylist (which blocked only java.lang.Runtime, not ProcessBuilder/ClassTool paths). Limiting factors: valid credentials are mandatory (PR:L, not unauthenticated), the account needs access to the email-sending feature, and resulting commands execute only with the LogicalDOC process's OS privileges rather than inherent root. No special non-default configuration is required beyond the feature being reachable to the authenticated user.

This is a credible, actionable RCE and not merely a high-CVSS paper tiger, but its exploitability is gated by authentication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms a network-reachable, low-complexity attack with no user interaction, yielding full high-impact compromise of confidentiality, integrity, and availability (VC:H/VI:H/VA:H) on the vulnerable system, with no scope change to subsequent systems (SC/SI/SA:N). The decisive mitigating signal is PR:L: an attacker must already hold a valid, authenticated LogicalDOC account that can reach the sendAsEmail function, so this is a privilege-escalation-to-RCE / malicious-insider / compromised-credential scenario rather than a pre-auth internet worm. No EPSS score was supplied in the input and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; no public exploit identified at time of analysis. However, the vulnerability was reported by VulnCheck with a detailed public advisory and the GitHub discussion, vulnerable source lines, and the fixing commit are all public, which substantially lowers the bar for weaponization even though no packaged PoC is referenced. Net: treat as a prioritized patch for any multi-user LogicalDOC deployment, weighted by how many semi-trusted users have accounts, while recognizing the real-world blast radius is narrower than an unauthenticated flaw.

An authenticated LogicalDOC user (or an attacker using stolen/low-privilege credentials) opens the 'send document as email' feature and embeds a Velocity template expression in the email subject or message field. When the server renders the template, the payload invokes SystemTool exec or ClassTool to spawn OS commands, bypassing the forbidRuntimeUsage denylist, and the commands run with the privileges of the LogicalDOC Java process. No public exploit is identified at time of analysis, but VulnCheck's advisory and the public source/commit references make the technique readily reproducible.