CVE-2026-109170 in Community Edition
Summary
by MITRE • 10/12/2026
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in LogicalDOC Community Edition versions through 9.3 represents a critical security flaw rooted in improper neutralization of special elements used in an SQL command, specifically categorized under CWE-564 as HQL Injection. This weakness resides within the DocumentsDataServlet component and is triggered by the unvalidated indexed parameter passed during request processing. The core technical issue arises from the application's failure to sanitize or validate user-supplied input before incorporating it into Hibernate Query Language statements. Because the index parameter is directly concatenated or interpolated into the query structure without adequate filtering, an attacker can inject arbitrary HQL syntax that alters the intended logic of the database retrieval operation.
The operational impact of this vulnerability is severe due to its interaction with authentication and authorization mechanisms. While the exploit requires initial authenticated access, it does not require administrative privileges; any user possessing read access to at least one folder within the system can leverage this flaw. By injecting boolean HQL expressions into the indexed parameter, an attacker can manipulate the query's filtering conditions. This manipulation effectively bypasses the folder scope restrictions and permission checks that are designed to limit data visibility based on organizational hierarchy or individual permissions. Consequently, the application returns results from database tables beyond the authorized boundaries of the requesting user account.
This capability allows for significant information disclosure attacks. An authenticated attacker can enumerate restricted document metadata, such as file names, creation dates, authors, and access logs, which are typically hidden from non-administrative users. Furthermore, by extending the injected HQL expressions to include UNION-based or error-based techniques common in SQL injection scenarios, an attacker may extract sensitive data directly from underlying database tables that store user credentials, configuration settings, or other proprietary information stored within the LogicalDOC backend. This undermines the fundamental principle of least privilege and compromises the confidentiality integrity of the document management system.
To mitigate this vulnerability, immediate patching to a version later than 9.3 is required as it addresses these input validation gaps. In environments where upgrading is not immediately feasible, defense-in-depth strategies should be employed. Input validation mechanisms must be implemented at the application layer to strictly enforce expected data types and ranges for all parameters passed to servlets handling database queries. Parameterized queries or prepared statements should replace direct string concatenation when constructing HQL commands to ensure that user input is treated as data rather than executable code. Additionally, implementing strict access control checks within the service layer before query execution can provide a secondary barrier against unauthorized data retrieval attempts aligned with ATT&CK technique T1078 for valid accounts and T1530 for data from cloud storage objects if applicable to the deployment architecture.