CVE-2026-109199: Improper Control of Generation of Code ('Code Injection') in LogicalDOC LogicalDOC Community Edition

CVE-2026-109199 is a code injection vulnerability in LogicalDOC Community Edition through version 9.3. Authenticated users can exploit this flaw by submitting specially crafted Velocity templates in the DocumentService.sendAsEmail subject or message fields. These templates can invoke SystemTool exec methods or ClassTool, circumventing the forbidRuntimeUsage denylist, which normally restricts runtime code execution. This allows attackers to execute arbitrary OS commands with the privileges of the LogicalDOC process, potentially leading to system compromise.

Successful exploitation allows authenticated attackers to execute arbitrary operating system commands with the privileges of the LogicalDOC process. This can lead to unauthorized system control, data compromise, or further attacks within the affected environment. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.7, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to LogicalDOC Community Edition to trusted users only and monitor for suspicious activity involving email template submissions. Avoid using untrusted Velocity templates in email fields.