These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. This vulnerability enables attackers with read access to any folder to inject boolean HQL expressions, potentially bypassing folder scope and read-permission checks, and leading to unauthorized access to sensit [truncated]
LogicalDOC Community Edition through 9.3 contains a SQL injection vulnerability via the firstLetter parameter of TagsDataServlet, allowing low-privileged authenticated users to execute crafted SQL and read sensitive user data. This vulnerability enables attackers to inject UNION SELECT statements and retrieve usernames, email addresses, and password hashes from ld_user. Defenders should assess exposure, a [truncated]
CVE-2026-109206 is a medium-severity username enumeration vulnerability in LogicalDOC Community Edition through version 9.3. The vulnerability exists in the AvatarServlet, allowing unauthenticated attackers to identify valid accounts by comparing 1x1 transparent images against real avatars. Defenders responsible for LogicalDOC Community Edition instances, especially those with publicly accessible AvatarSe [truncated]
LogicalDOC Community Edition through 9.3 is vulnerable to unauthenticated file upload via UploadServlet, allowing remote attackers to write files to disk without a session, potentially leading to disk space exhaustion. Defenders should assess exposure and verify disk space usage to mitigate potential service disruption due to unauthenticated file uploads. This vulnerability highlights the importance of se [truncated]
LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet. This vulnerability allows attackers to obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses. The vulnerability is caused by the servlet's failure to bind password recovery [truncated]
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet. This allows authenticated users to download restricted PDF documents by enumerating sequential docId values and using the version parameter. The vulnerability requires verification and remediation priority in deployments with multiple authenticated users, especially those with complex access [truncated]
PatchSiren debrief for CVE-2026-109202: LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet. The vulnerability allows authenticated users to export restricted folders by supplying a folderId parameter, potentially leading to unauthorized access to sensitive documents. Defenders should assess exposure and potential impact, focusing on authenticated users and restricted fol [truncated]
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. This vulnerability can lead to data disclosure and tampering. Defenders should assess exposure and prioritize remediation, especially in environments where document access and modification are sensitive. The v [truncated]
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. This vulnerability enables attackers to invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges. D [truncated]
LogicalDOC Enterprise up to and including v9.1.1 is vulnerable to Local File Inclusion (LFI) via the OnlyOfficeEditor servlet class. This vulnerability allows an authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside designated directories. The vulnerability has a significant impact on confidentiality and could lead to data brea [truncated]
LogicalDOC Enterprise up to and including v9.1.1 is vulnerable to blind SQL injection in the ComparisonServlet component. This allows authenticated users to manipulate SQL queries via crafted input, potentially leading to data breaches or system compromise. The vulnerability affects operators, platforms, and security teams responsible for maintaining LogicalDOC Enterprise deployments. Users should assess [truncated]
LogicalDOC Enterprise version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host. This vulnerability has a high CVSS score of 7.3, indicating a high severity. Users of LogicalDOC Enterprise version up to and before [truncated]
