CVE-2026-109199 LogicalDOC CVE debrief

Who should care

Defenders responsible for LogicalDOC Community Edition deployments, particularly those with authenticated user access to DocumentService.sendAsEmail, should assess exposure and prioritize remediation.

Why it matters

CVE-2026-109199 is a high-severity code injection vulnerability in LogicalDOC Community Edition that allows authenticated users to execute OS commands. Defenders should prioritize remediation and restrict template usage to prevent exploitation.

• Execution of arbitrary OS commands with LogicalDOC process privileges
• Potential for lateral movement and further exploitation
• Need for input validation and sanitization to prevent template injection
• Verification of patch application to prevent exploitation

Technical summary

The vulnerability allows authenticated users to execute OS commands by submitting malicious Velocity templates in DocumentService.sendAsEmail subject or message fields. This is possible because the forbidRuntimeUsage denylist can be bypassed, enabling attackers to leverage SystemTool exec methods or ClassTool. The vulnerability affects LogicalDOC Community Edition through version 9.3 and requires immediate attention to restrict template usage and implement additional input validation and sanitization measures. Defenders should prioritize remediation to prevent potential lateral movement and further exploitation.

Defensive priority

Authenticated users with DocumentService.sendAsEmail privileges require immediate attention to restrict template usage.

Recommended defensive actions

• Restrict Velocity template usage in DocumentService.sendAsEmail for authenticated users
• Implement additional input validation and sanitization for user-submitted templates
• Monitor for suspicious activity related to DocumentService.sendAsEmail
• Apply the patch commit to update the affected DocumentServiceImpl.java file
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official metadata. Supplemental sources describe technical details and a patch commit. The vulnerability has been described in various references, including technical descriptions and patch commits. However, the exact scope of affected deployments and specific exploitation attempts are not detailed in the available sources. Defenders should verify patch application and restrict template usage to prevent exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.