Login Request a demo
High severity · published Oct 12, 2026
CVE-2026-109199
LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LC
LogicalDOC Community Edition · LogicalDOC
through 9.3 · source: vendor
Affected product
LC
LogicalDOC Community Edition
LogicalDOC
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109199
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109199
technical-description
https://github.com/logicaldoc/community/discussions/119
patch
https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java#L1543
technical-description
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java#L59
product
https://github.com/logicaldoc/community
third-party-advisory
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injection-via-velocity-sendasemail-template
More from LogicalDOC Community Edition
8.3
CVE-2026-109201
LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService
7.5
CVE-2026-109205
LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet
6.5
CVE-2026-109203
LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
6.5
CVE-2026-109202
LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet
6.5
CVE-2026-109170
LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter