What’s Vulnerable › Vulnerabilities

CVE-2026-109169: LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-89

Description

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.

Affected products

• LogicalDOC Community Edition: through 9.3

References

• https://github.com/logicaldoc/community
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41
• https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee
• https://github.com/logicaldoc/community/discussions/119
• https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via-tags-xml-firstletter

Get alerted when CVE-2026-109169 or the next vulnerability affects your stack