What’s Vulnerable › Vulnerabilities
CVE-2024-12019: Arbitrary File Read via Document API
- Severity: high (CVSS 7.1 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-03-14 · updated 2026-06-17
- Weakness: CWE-23
Description
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
Affected products
- LogicalDOC Enterprise: before 9.1 — fixed in 9.1
- LogicalDOC Community: before 9.1 — fixed in 9.1
How to fix
Upgrade to a fixed version: LogicalDOC Enterprise 9.1; LogicalDOC Community 9.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-12019 or the next vulnerability affects your stack