LogicalDOC Community Edition: Code injection via Velocity templates in email function
Summary
LogicalDOC Community Edition through 9.3 contains a code injection flaw (CWE-94) in the DocumentService.sendAsEmail function. An authenticated user can submit Velocity templates in the subject or message fields and bypass the denylist that restricts runtime usage, so OS commands run with the privileges of the LogicalDOC process. Exposure is highest for internet-facing or multi-user instances, because only a low-privilege account is needed.
Affected
- LogicalDOC Community Edition 0 up to and including 9.3 (per CVE record and VulnCheck)
- Whether 9.3.1 is also affected is unconfirmed
Fixed in
- Unknown. No confirmed fixed version has been published by the vendor.
- A patch commit (66c3a6b9) is referenced, but its content could not be verified.
Workaround
- No vendor-confirmed workaround. A third-party source suggests avoiding Velocity processing of user input (unverified).
- Restrict which accounts can use the email, template and automation features.
- Do not expose the DMS web interface directly to the internet; use a VPN or an authenticating reverse proxy.
- Run the service under a restricted service account.
Exploitation
- Not listed in CISA KEV; no known exploitation reported.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- Public technical details exist in a GitHub discussion by the finder.
- A public proof of concept is mentioned by one aggregator but was not verified.
Our recommendation
- Inventory all LogicalDOC Community Edition instances and their versions.
- Restrict access now: remove internet exposure and limit accounts with email and template rights.
- Monitor for unexpected child processes spawned by the Java service.
- Take a verified backup before any upgrade.
- Upgrade to a vendor-confirmed fixed release as soon as one is available, and monitor the LogicalDOC GitHub and vendor channels.
- Priority: high for internet-exposed or multi-user instances, medium for internal instances with trusted users.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- LogicalDOC GitHub discussion 119 (finder's technical details) github.com
- SystemTool.java at tag 9.3 github.com
- DocumentServiceImpl.java at tag 9.3 github.com
- Patch commit 66c3a6b9 (unverified content) github.com
- OpenCVE CVE-2026-109199 app.opencve.io
- VulDB entry 416929 vuldb.com
- Aggregator status page (hol.org) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:54.
Original description (NVD)
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
NVD references (6)
- https://github.com/logicaldoc/community
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation…
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/D…
- https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00
- https://github.com/logicaldoc/community/discussions/119
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injection-via-velocity-sen…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.