LogicalDOC vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-109205 LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files High 8.7 · Oct 12, 2026
• CVE-2026-109203 LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download reHigh 7.1 · Oct 12, 2026
• CVE-2026-109202 LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restHigh 7.1 · Oct 12, 2026
• CVE-2026-109201 LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to accHigh 8.7 · Oct 12, 2026
• CVE-2026-109199 LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity tHigh 8.7 · Oct 12, 2026
• CVE-2026-109170 LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries vHigh 7.1 · Oct 12, 2026
• CVE-2026-109169 LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter paramHigh 7.1 · Oct 12, 2026
• CVE-2024-54449 The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlHigh 8.7 · Mar 14, 2025
• CVE-2024-54448 The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system.High 8.6 · Mar 14, 2025
• CVE-2024-54447 Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers.High 7.1 · Mar 14, 2025
• CVE-2024-54446 Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers.High 7.1 · Mar 14, 2025
• CVE-2024-54445 Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers.High 8.7 · Mar 14, 2025
• CVE-2024-12245 Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers.High 8.7 · Mar 14, 2025
• CVE-2024-12019 The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlyingHigh 7.1 · Mar 14, 2025
• CVE-2020-13542 A local privilege elevation vulnerability exists in the file system permissions of LogicalDoc 8.5.1 installation.High 7.8 · Dec 3, 2020
• CVE-2020-10366 LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365.High 7.5 · Apr 7, 2020
• CVE-2020-9423 LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database.Critical 9.8 · Mar 18, 2020
• CVE-2019-9723 LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the claHigh 7.1 · May 30, 2019
• CVE-2017-1000022 LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation.High 8.8 · Jul 17, 2017
• CVE-2017-1000021 LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents.High 8.8 · Jul 17, 2017