Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.6

LogicalDOC admins can execute system commands remotely

CVE-2024-54448 · published 1 year ago
Summary

The Automation Scripting feature in LogicalDOC can be used by an administrator—or someone given the same rights—to run any command on the server that hosts the application. If an attacker obtains such an account, they could take control of the underlying operating system. Limit admin privileges, disable the scripting feature if it isn’t needed, and apply the latest updates from LogicalDOC.

What to do
  • Update logicaldoc logicaldoc to version 9.1 or later.
  • Update logicaldoc logicaldoc community to version 9.1 or later.
  • Update logicaldoc logicaldoc enterprise to version 9.1 or later.
Affected software
VendorProductAffected versions
logicaldoc logicaldoc < 9.1
cpe:2.3:a:logicaldoc:logicaldoc:*:*:*:*:community:*:*:*
logicaldoc logicaldoc community < 9.1
logicaldoc logicaldoc enterprise < 9.1
Original advisory text
Remote Code Execution (RCE) via Automation Scripting
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
8.6 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published14 Mar 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-54448 · NVD
CVE-2024-54448 · MITRE
Track software like this
Free during beta