CVE-2026-109169 LogicalDOC CVE debrief

Who should care

Defenders responsible for LogicalDOC Community Edition deployments should assess exposure and apply patches or mitigations. System administrators and security teams should verify if their systems are running affected versions and take necessary actions to restrict access to TagsDataServlet and monitor for suspicious activity.

Why it matters

The SQL injection vulnerability in LogicalDOC Community Edition through 9.3 allows low-privileged authenticated users to execute crafted SQL and read sensitive user data. Defenders should prioritize verifying exposure, applying patches, and monitoring for suspicious activity to minimize potential impacts.

• Read sensitive user data, including usernames, email addresses, and password hashes.
• Potential lateral movement within the network if exploitation is successful.
• Required verification of exposure and patch application for affected systems.
• Monitoring for suspicious SQL queries to detect potential exploitation attempts.

Technical summary

The vulnerability exists in the TagsDataServlet of LogicalDOC Community Edition through 9.3, where the firstLetter parameter is vulnerable to SQL injection. Low-privileged authenticated users can inject UNION SELECT statements to read sensitive user data, such as usernames, email addresses, and password hashes. The vulnerability allows attackers to execute crafted SQL and retrieve sensitive information from the ld_user table. Defenders should prioritize verifying exposure, applying patches, and monitoring for suspicious SQL queries to minimize potential impacts.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on restricting access to TagsDataServlet and monitoring for suspicious SQL queries.

Recommended defensive actions

• Verify exposure by checking if the system is running LogicalDOC Community Edition version 9.3 or earlier.
• Apply patches by updating to a version beyond 9.3 or applying the provided patch commit.
• Restrict access to TagsDataServlet to minimize the attack surface.
• Monitor for suspicious SQL queries and implement additional security measures to detect potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the SQL injection vulnerability in LogicalDOC Community Edition through 9.3. The vulnerability allows low-privileged authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.