Threat Intelligence Database

LogicalDOC Community Edition versions up to 9.3 have a missing authorization vulnerability in the ConvertPdf servlet. This flaw allows authenticated users to download restricted PDF documents by enumerating sequential document IDs and using the version parameter to access PDFs and their versions from unauthorized folders. The vulnerability has a high severity rating with a CVSS score of 7.1.

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

LogicalDOC Community Edition versions up to 9.3 contain a server-side request forgery (SSRF) vulnerability in the default-enabled XMLConverter component. Authenticated users can upload XML documents with stylesheet href attributes that point to internal URLs using protocols such as http, ftp, file, or jar. This allows the server to make unintended requests and apply attacker-controlled XSLT during document conversion.

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

LogicalDOC Community Edition versions up to 9.3 contain an HQL injection vulnerability in the DocumentsDataServlet component. Authenticated users with read access to any folder can exploit this flaw by manipulating the unvalidated indexed parameter to inject boolean HQL expressions. This allows attackers to bypass folder scope and read-permission checks, enabling them to list restricted document metadata and extract database contents. The vulnerability has a high severity rating with a CVSS 4.0 score of 7.1.

LogicalDOC Community Edition versions up to 9.3 contain an SQL injection vulnerability in the TagsDataServlet component. Authenticated low-privileged users can exploit this flaw by manipulating the firstLetter parameter to execute crafted SQL queries. This allows attackers to extract sensitive information such as usernames, email addresses, and password hashes from the ld_user database table.

LogicalDOC Community Edition versions up to 9.3 contain a username enumeration vulnerability. This issue arises because the AvatarServlet endpoint does not validate sessions, allowing unauthenticated attackers to supply userId parameters and distinguish valid usernames by comparing avatar images. This vulnerability enables attackers to identify valid accounts and retrieve profile pictures without authentication.

LogicalDOC Community Edition versions up to 9.3 have an unauthenticated file upload vulnerability in the UploadServlet. This flaw allows remote attackers to upload files without a session, repeatedly sending multipart requests with unlimited file parts to the /upload endpoint. The uploaded files persist in temporary directories that are not cleaned, potentially exhausting server disk space and causing denial of service.

LogicalDOC Community Edition versions up to 9.3 contain a vulnerability in the password recovery mechanism. The PswRecovery servlet does not properly bind password recovery tickets to the requesting user, allowing attackers to reuse tickets across accounts. This flaw enables attackers to reset passwords of other users, including administrators, potentially locking them out and exposing their email addresses.