CVE-2024-54448: CWE-94 Improper Control of Generation of Code ('Code Injection') in LogicalDOC LogicalDOC Community

The Automation Scripting functionality in LogicalDOC Community contains a code injection vulnerability (CWE-94) that permits an attacker with administrator privileges or explicit Automation Scripting access to execute arbitrary system commands on the underlying operating system. This vulnerability allows command execution on the web server running LogicalDOC, potentially compromising the server environment. The CVSS 4.0 base score is 8.6, indicating high severity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with elevated privileges to run arbitrary system commands on the server hosting LogicalDOC Community. This can lead to full system compromise, unauthorized data access, or disruption of service depending on the commands executed. The vulnerability requires high privileges (administrator or explicit Automation Scripting access) and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Automation Scripting access strictly to trusted administrators and monitor for unauthorized privilege escalations. Avoid granting administrator privileges unnecessarily.