What’s Vulnerable › Vulnerabilities

CVE-2026-109199: LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-18
• Weakness: CWE-94

Description

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

Affected products

• LogicalDOC Community Edition: through 9.3

References

• https://github.com/logicaldoc/community
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java#L59
• https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java#L1543
• https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00
• https://github.com/logicaldoc/community/discussions/119
• https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injection-via-velocity-sendasemail-template

Get alerted when CVE-2026-109199 or the next vulnerability affects your stack