CVE-2026-109199

Summary

LogicalDOC Community Edition contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in email fields. This flaw enables attackers to run arbitrary commands with the privileges of the LogicalDOC process, potentially leading to full system compromise.

Exploitability

Exploitation requires an authenticated user account and is relatively straightforward, involving submission of specially crafted Velocity templates in email fields to invoke system execution methods.

Blast radius

If exploited, this vulnerability could allow attackers to execute arbitrary OS commands on the LogicalDOC server with the same privileges as the application, potentially leading to data exfiltration, lateral movement, or complete system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to LogicalDOC Community Edition 9.4 or later to remediate this code injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.