Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-109199: LogicalDOC Community Edition lets logged-in users run system commands

CVE-2026-109199 · published 26 days ago

Summary

In LogicalDOC Community Edition up to version 9.3, a user who is signed in can craft a special email template that causes the server to execute operating‑system commands. This means an attacker with a valid account could run commands with the same rights as the LogicalDOC service, potentially accessing or altering data. Apply the latest update from the vendor or restrict template use to trusted users while you wait for a patch.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
logicaldoc	logicaldoc community edition	<= 9.3

Original advisory text

LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

References

https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b21985... Patch
https://github.com/logicaldoc/community Product
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/c... Third Party Advisory
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java... Third Party Advisory
https://github.com/logicaldoc/community/discussions/119 Third Party Advisory
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-co... Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-1091... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-109199 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

9.4 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published12 Oct 2026

Updated4 Nov 2026

First seen12 Oct 2026

Sources

CVE-2026-109199 · NVD

CVE-2026-109199 · MITRE

CVE-2026-109199 · OSV

Track software like this

Free during beta