LogicalDOC vulnerabilities
We track 11 vulnerabilities in LogicalDOC products across 5 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 12, 2026.
Latest LogicalDOC vulnerabilities
- 7.5 High severity
LogicalDOC Community Edition: Allocation of Resources Without Limits or Throttling
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file part
- 8.3 High severity
LogicalDOC Community Edition: Missing Authorization
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, rei
- 8.8 High severity
LogicalDOC Community Edition: Improper Control of Generation of Code
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool e
- 8.1 High severity
Community Edition: Improper Restriction of Excessive Authentication Attempts
A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such manipulation leads to improper restriction of excessive authentication attempts.
- 8.8 High severity
LogicalDOC Community: Relative Path Traversal
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate
- 7.2 High severity
LogicalDOC Community: Improper Control of Generation of Code
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed
- 7.1 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Saved search functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presen
- 7.1 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Document history functionality contains a blind SQL injection that can be exploited by authenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the pr
- 8.7 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Login functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence or
- 8.7 High severity
LogicalDOC Community: Improper Neutralization of Special Elements used in an SQL Command
Logout functionality contains a blind SQL injection that can be exploited by unauthenticated attackers. Using a time-based blind SQLi technique the attacker can disclose all database contents. Account takeover is a potential outcome depending on the presence o
- 7.1 High severity
LogicalDOC Community: Relative Path Traversal
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing documen