LogicalDOC Community Edition EUVD-2026-97440

Exploitation requires only network reachability to the LogicalDOC UploadServlet /upload endpoint; per the description the servlet accepts multipart file-upload requests without a valid session, so no authentication, credentials, or user interaction are needed (consistent with PR:N/UI:N). The specific defect is that uploaded file parts are written to temporary directories that are not cleaned up and part count is unlimited, so the limiting factor is purely exposure: an instance must have /upload reachable by the attacker (e.g. internet-facing or network-adjacent). There is no non-default configuration requirement called out - the flaw affects LogicalDOC Community Edition through 9.3 - and impact is limited to availability (disk exhaustion), not data disclosure or code execution. Applying the vendor patch (commit 90b7ebea) removes the vulnerable handling.

This is a genuine but bounded availability risk, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the impact metrics (VC:N/VI:N/VA:H) correctly scope this as a pure availability (disk-exhaustion) issue with no confidentiality or integrity impact - matching CWE-770 (uncontrolled resource allocation). The 8.7 score is high precisely because exploitation is trivial and unauthenticated, not because of system compromise; defenders should read this as a denial-of-service priority, not a remote-code-execution one. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. Net: real and easy to trigger against exposed instances, but the worst outcome is service/disk outage, so it should be prioritized for internet-facing LogicalDOC deployments while recognizing it does not grant attacker control of the host. The vendor patch availability raises urgency since a fix exists to close the window.

A remote attacker with no credentials sends repeated HTTP multipart POST requests to the /upload endpoint, each containing many file parts, which UploadServlet writes into temporary directories without a valid session and without cleanup. By looping these requests the attacker steadily fills the server disk until LogicalDOC and potentially co-located services fail. No public exploit code is referenced, but the attack requires only a standard HTTP client and the low complexity (AC:L) makes scripting it trivial.