What’s Vulnerable › Vulnerabilities

CVE-2024-54448: Remote Code Execution (RCE) via Automation Scripting

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-14 · updated 2026-08-26
• Weakness: CWE-94

Description

The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.

Affected products

• LogicalDOC Enterprise: before 9.1 — fixed in 9.1

How to fix

Upgrade to a fixed version: LogicalDOC Enterprise 9.1. Check the vendor advisory for mitigations.

References

• https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.html
• http://seclists.org/fulldisclosure/2026/Aug/85

Get alerted when CVE-2024-54448 or the next vulnerability affects your stack