CVE-2026-109169: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in LogicalDOC LogicalDOC Community Edition

CVE-2026-109169 is an SQL injection vulnerability affecting LogicalDOC Community Edition through version 9.3. The flaw exists in the TagsDataServlet component where the firstLetter parameter is improperly neutralized, enabling authenticated users with low privileges to inject UNION SELECT statements. Exploitation results in unauthorized disclosure of sensitive user data including usernames, email addresses, and password hashes contained in the ld_user table. The vulnerability has a CVSS 4.0 base score of 7.1, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality.

Successful exploitation allows low-privileged authenticated attackers to read sensitive user information from the application database, including usernames, email addresses, and password hashes. This can lead to further attacks such as credential compromise or privilege escalation. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious activity related to the TagsDataServlet component. Avoid exposing the vulnerable parameter to untrusted users.