PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-45868 LogicalDOC CVE debrief

LogicalDOC Enterprise versions up to and including 9.1.1 are vulnerable to blind SQL injection via the ComparisonServlet component. An authenticated user can manipulate SQL queries with crafted input, potentially allowing unauthorized data access or modification. This vulnerability can lead to data breaches or integrity compromise, emphasizing the need for validation of SQL query input and authentication mechanisms. Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated user accounts and SQL query validation.

Vendor
LogicalDOC
Product
LogicalDOC Enterprise
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-16
Original CVE updated
2026-10-12
Advisory published
2026-07-16
Advisory updated
2026-10-12

Who should care

Defenders responsible for LogicalDOC Enterprise deployments, particularly those with authenticated user accounts, should assess exposure and prioritize verification of SQL query validation and authentication mechanisms.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact of the blind SQL injection vulnerability in LogicalDOC Enterprise versions up to and including 9.1.1, focusing on authenticated user accounts and SQL query validation.

  • Potential unauthorized data access or modification via SQL injection
  • Increased risk of data breaches or integrity compromise
  • Need for validation of SQL query input and authentication mechanisms
  • Potential impact on database performance or availability

Technical summary

The ComparisonServlet component in LogicalDOC Enterprise versions up to and including 9.1.1 is vulnerable to blind SQL injection. An authenticated user can manipulate SQL queries via crafted input, potentially allowing unauthorized data access or modification.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on authenticated user accounts and SQL query validation.

Recommended defensive actions

  • Verify LogicalDOC Enterprise versions up to and including 9.1.1 are in use and assess exposure
  • Validate SQL query input and authentication mechanisms
  • Implement additional monitoring for suspicious database activity

Evidence notes

The CVE record and NVD detail page provide official vulnerability information. Additional source references are available on GitHub and the LogicalDOC website.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-45868 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-45868

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-45868 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-45868

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.