CVE-2026-109170: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in LogicalDOC LogicalDOC Community Edition

CVE-2026-109170 describes an HQL injection vulnerability in LogicalDOC Community Edition through version 9.3. The flaw exists in the DocumentsDataServlet where the indexed parameter is not properly validated, allowing authenticated users with read access to inject boolean HQL expressions. This injection bypasses folder scope and read-permission checks, permitting unauthorized access to restricted document metadata and database contents. The vulnerability is remotely exploitable without user interaction and requires low attack complexity with privileges of an authenticated user with read access.

An attacker with authenticated read access to any folder can exploit this vulnerability to bypass access controls and read permissions, thereby gaining unauthorized access to restricted document metadata and potentially sensitive database contents. This could lead to information disclosure within the affected LogicalDOC Community Edition environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to the minimum necessary and monitor for unusual query activity related to the DocumentsDataServlet indexed parameter.