Logicaldoc Community Edition
Monthly
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote attackers write files into application temporary directories that are never cleaned up, exhausting server disk space and degrading or halting the document management service. The UploadServlet accepts file parts without a valid session and imposes no limit on the number of parts per request, so no credentials, user interaction, or non-default configuration are needed - only network reachability to the endpoint. Impact is confined to availability (integrity and confidentiality are unaffected, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector), no public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Missing per-document authorization checks in the ConvertPdf servlet of LogicalDOC Community Edition through 9.3 allow any authenticated user to download PDF documents - and every stored version of them - from folders they are not permitted to access. An attacker with a low-privileged account can enumerate the sequential docId parameter and combine it with the version parameter to pull PDFs outside their permission scope; no administrative rights, user interaction, or non-default configuration are required, though valid credentials are mandatory since the flaw is not reachable unauthenticated. Impact is confined to confidentiality (bulk disclosure of restricted PDF content and revision history), with no write, modification, or denial-of-service capability; no public exploit identified at time of analysis and no CISA KEV listing.
Authenticated users of LogicalDOC Community Edition (versions through 9.3) can bypass folder-level access controls and download the full contents of any restricted folder as a ZIP archive by calling the /zip-export servlet with an arbitrary folderId parameter. Exploitation requires only a valid low-privilege session (CVSS 3.1 PR:L, C:H/I:N/A:N), and because folder IDs are sequential numeric identifiers they can be enumerated, so the practical barrier is low for any user holding an account. The vulnerability is not confirmed as actively exploited (CISA KEV) and no public exploit code was identified at time of analysis, but a vendor fix is available; the impact is limited to confidentiality (document disclosure) with no write or availability effect, making this a moderate-priority information-exposure issue rather than an emergency.
Missing authorization in LogicalDOC Community Edition through 9.3 allows any authenticated low-privilege user to disclose, tamper with, or delete documents they are not permitted to access, by invoking SoapDocumentService operations such as copy, getExtractedText, deleteVersion, reindex, deleteLink, and restore over SOAP or the /services/rest/document REST interface. Because document identifiers are sequential, an attacker with ordinary credentials can simply enumerate IDs and reach other users' content with no administrative rights and no user interaction, yielding high confidentiality and integrity impact with limited availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; vendor-published score 8.7). No public exploit code or confirmed active exploitation was identified at time of analysis, and the main barrier to attack is the requirement for a valid account, so exposure is greatest where account creation is open or user segregation is weak.
Authenticated remote code execution in LogicalDOC Community Edition through 9.3 allows any user with a valid account to execute OS commands with the privileges of the LogicalDOC process by injecting Velocity template expressions into the subject or message fields of DocumentService.sendAsEmail. The attacker can bypass the forbidRuntimeUsage denylist by invoking SystemTool exec methods or ClassTool, as the denylist only blocked java.lang.Runtime and not java.lang.ProcessBuilder. No public exploit code has been identified at time of analysis, but a vendor fix is available as commit 66c3a6b9b47f9f6c624047eea43b219851378f00 and the issue is tracked by VulnCheck.
An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.
SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.
Username enumeration in LogicalDOC Community Edition through 9.3 allows remote unauthenticated attackers to determine which accounts exist and to retrieve their profile pictures by requesting the /avatar endpoint with candidate usernames or numeric IDs. The AvatarServlet performed no session validation, so the only prerequisite is network reachability of the endpoint; identification relies on distinguishing a generic 1x1 transparent image returned for unknown identifiers from a real avatar returned for valid accounts. The disclosure is limited to account existence and profile imagery (confidentiality-low, no authentication, credentials, or write access granted), making this a low-to-moderate priority issue rather than a critical one; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited.
Improper authorization in the PswRecovery servlet of LogicalDOC Community Edition through 9.3 lets any user who can hold a valid low-privileged account hijack the password-recovery flow and reset credentials for arbitrary accounts, including administrators. Recovery tickets are issued but never bound to the requesting user, so an attacker can obtain a ticket for their own account and replay it with any arbitrary userId parameter, forcing the victim's password to a newly generated value, locking the victim out, and disclosing the victim's registered email address in the servlet response. The flaw is rated CVSS 5.3 (CVSS 4.0 base) with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; exploitation requires a valid LogicalDOC account, no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated users on LogicalDOC Community Edition through 9.3 can abuse the default-enabled XMLConverter to make the server fetch attacker-chosen URLs and apply attacker-controlled XSLT during document conversion, because xml-stylesheet href values are resolved without scheme or host allowlisting. The vulnerable converter accepts http, ftp, file, and jar URLs, so a low-privileged user who can upload an XML document can reach internal services, read local files, or influence the resulting converted output. The issue is rated medium severity (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), authentication is mandatory and no unauthenticated path exists, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated multipart uploads to the LogicalDOC Community Edition /upload endpoint (through version 9.3) let remote attackers write files into application temporary directories that are never cleaned up, exhausting server disk space and degrading or halting the document management service. The UploadServlet accepts file parts without a valid session and imposes no limit on the number of parts per request, so no credentials, user interaction, or non-default configuration are needed - only network reachability to the endpoint. Impact is confined to availability (integrity and confidentiality are unaffected, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H vector), no public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Missing per-document authorization checks in the ConvertPdf servlet of LogicalDOC Community Edition through 9.3 allow any authenticated user to download PDF documents - and every stored version of them - from folders they are not permitted to access. An attacker with a low-privileged account can enumerate the sequential docId parameter and combine it with the version parameter to pull PDFs outside their permission scope; no administrative rights, user interaction, or non-default configuration are required, though valid credentials are mandatory since the flaw is not reachable unauthenticated. Impact is confined to confidentiality (bulk disclosure of restricted PDF content and revision history), with no write, modification, or denial-of-service capability; no public exploit identified at time of analysis and no CISA KEV listing.
Authenticated users of LogicalDOC Community Edition (versions through 9.3) can bypass folder-level access controls and download the full contents of any restricted folder as a ZIP archive by calling the /zip-export servlet with an arbitrary folderId parameter. Exploitation requires only a valid low-privilege session (CVSS 3.1 PR:L, C:H/I:N/A:N), and because folder IDs are sequential numeric identifiers they can be enumerated, so the practical barrier is low for any user holding an account. The vulnerability is not confirmed as actively exploited (CISA KEV) and no public exploit code was identified at time of analysis, but a vendor fix is available; the impact is limited to confidentiality (document disclosure) with no write or availability effect, making this a moderate-priority information-exposure issue rather than an emergency.
Missing authorization in LogicalDOC Community Edition through 9.3 allows any authenticated low-privilege user to disclose, tamper with, or delete documents they are not permitted to access, by invoking SoapDocumentService operations such as copy, getExtractedText, deleteVersion, reindex, deleteLink, and restore over SOAP or the /services/rest/document REST interface. Because document identifiers are sequential, an attacker with ordinary credentials can simply enumerate IDs and reach other users' content with no administrative rights and no user interaction, yielding high confidentiality and integrity impact with limited availability impact (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L; vendor-published score 8.7). No public exploit code or confirmed active exploitation was identified at time of analysis, and the main barrier to attack is the requirement for a valid account, so exposure is greatest where account creation is open or user segregation is weak.
Authenticated remote code execution in LogicalDOC Community Edition through 9.3 allows any user with a valid account to execute OS commands with the privileges of the LogicalDOC process by injecting Velocity template expressions into the subject or message fields of DocumentService.sendAsEmail. The attacker can bypass the forbidRuntimeUsage denylist by invoking SystemTool exec methods or ClassTool, as the denylist only blocked java.lang.Runtime and not java.lang.ProcessBuilder. No public exploit code has been identified at time of analysis, but a vendor fix is available as commit 66c3a6b9b47f9f6c624047eea43b219851378f00 and the issue is tracked by VulnCheck.
An HQL injection in LogicalDOC Community Edition through 9.3 lets any authenticated user who holds read permission on a single folder escape that folder's scope and read document metadata and database contents they are not entitled to see. The flaw is reachable through the documents.xml data endpoint (DocumentsDataServlet), where the 'indexed' request parameter is concatenated unvalidated into a Hibernate query, so the primary barrier is only the requirement for a low-privileged, read-only account; impact is limited to confidentiality with no modification or denial of service. There is no vendor patch version confirmed in the available data beyond the upstream fix commit, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, though an advisory and public discussion exist.
SQL injection in LogicalDOC Community Edition through 9.3 allows authenticated low-privileged users to execute crafted SQL via the firstLetter parameter of TagsDataServlet, enabling UNION SELECT statements to be returned in the XML tag list and disclosing usernames, email addresses, and password hashes from the ld_user table. This is a credible but bounded risk: the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) and independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirm that an authenticated session is required, with no integrity or availability impact; no public exploit identified at time of analysis. The upstream fix commit (8428bfb) parameterizes the vulnerable LIKE clause, but a tagged patched release is not independently confirmed.
Username enumeration in LogicalDOC Community Edition through 9.3 allows remote unauthenticated attackers to determine which accounts exist and to retrieve their profile pictures by requesting the /avatar endpoint with candidate usernames or numeric IDs. The AvatarServlet performed no session validation, so the only prerequisite is network reachability of the endpoint; identification relies on distinguishing a generic 1x1 transparent image returned for unknown identifiers from a real avatar returned for valid accounts. The disclosure is limited to account existence and profile imagery (confidentiality-low, no authentication, credentials, or write access granted), making this a low-to-moderate priority issue rather than a critical one; no public exploit code was identified at time of analysis and the issue is not known to be actively exploited.
Improper authorization in the PswRecovery servlet of LogicalDOC Community Edition through 9.3 lets any user who can hold a valid low-privileged account hijack the password-recovery flow and reset credentials for arbitrary accounts, including administrators. Recovery tickets are issued but never bound to the requesting user, so an attacker can obtain a ticket for their own account and replay it with any arbitrary userId parameter, forcing the victim's password to a newly generated value, locking the victim out, and disclosing the victim's registered email address in the servlet response. The flaw is rated CVSS 5.3 (CVSS 4.0 base) with an assessed 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L; exploitation requires a valid LogicalDOC account, no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated users on LogicalDOC Community Edition through 9.3 can abuse the default-enabled XMLConverter to make the server fetch attacker-chosen URLs and apply attacker-controlled XSLT during document conversion, because xml-stylesheet href values are resolved without scheme or host allowlisting. The vulnerable converter accepts http, ftp, file, and jar URLs, so a low-privileged user who can upload an XML document can reach internal services, read local files, or influence the resulting converted output. The issue is rated medium severity (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), authentication is mandatory and no unauthenticated path exists, and no public exploit code or confirmed active exploitation was identified at time of analysis.