{"id":"CVE-2026-109199","published":"2026-10-12T14:17:10.373","lastModified":"2026-10-13T20:41:35.943","description":"LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/logicaldoc/community","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java#L59","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java#L1543","tags":[]},{"url":"https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00","tags":[]},{"url":"https://github.com/logicaldoc/community/discussions/119","tags":[]},{"url":"https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injection-via-velocity-sendasemail-template","tags":[]}],"exploitRefs":[{"url":"https://github.com/logicaldoc/community","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java#L59","tags":[]},{"url":"https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java#L1543","tags":[]},{"url":"https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00","tags":[]},{"url":"https://github.com/logicaldoc/community/discussions/119","tags":[]}],"hasPoc":true,"ai":{"summary":"LogicalDOC Community Edition contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in email fields. This flaw enables attackers to run arbitrary commands with the privileges of the LogicalDOC process, potentially leading to full system compromise.","exploitability":"Exploitation requires an authenticated user account and is relatively straightforward, involving submission of specially crafted Velocity templates in email fields to invoke system execution methods.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary OS commands on the LogicalDOC server with the same privileges as the application, potentially leading to data exfiltration, lateral movement, or complete system compromise.","remediation":"Upgrade to LogicalDOC Community Edition 9.4 or later to remediate this code injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","code-injection","web","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:53:04.816Z"}}