CVE-2026-109169

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.

• https://github.com/logicaldoc/community
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41
• https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee
• https://github.com/logicaldoc/community/discussions/119

• https://github.com/logicaldoc/community
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41
• https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee
• https://github.com/logicaldoc/community/discussions/119
• https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via-tags-xml-firstletter

• HIGHCVE-2015-20122
• HIGHCVE-2019-25776PoC
• HIGHCVE-2021-48008
• HIGHCVE-2022-4997
• CRITICALCVE-2023-54399
• CRITICALCVE-2023-54400PoC
• HIGHCVE-2025-45871PoC
• HIGHCVE-2025-46773

Related by shared AI tags and CWE weakness class. Browse the full archive.