CVE-2026-109199 in Community Edition
Summary
by MITRE • 10/12/2026
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability resides within LogicalDOC Community Edition versions up through 9.3 and represents a critical server-side code injection flaw rooted in improper validation of user-supplied input destined for template engines. Specifically, the DocumentService component processes subject and message fields intended for email notifications by rendering them using Velocity templates. This architectural decision introduces significant risk because it allows authenticated users to inject arbitrary Velocity expressions into these fields. The core technical failure lies in the application's inability to sufficiently sanitize or restrict the execution context of these injected scripts, thereby granting attackers a pathway to execute operating system commands with the privileges associated with the LogicalDOC process account.
From an exploitation perspective, this vulnerability enables remote code execution by leveraging specific Velocity tools that bypass existing security controls. Attackers can invoke methods from SystemTool such as exec or utilize ClassTool to instantiate classes and call their methods dynamically. These actions effectively circumvent the application's forbidRuntimeUsage denylist, which is designed to prevent the use of dangerous runtime features. By manipulating these internal APIs through the Velocity template engine, an authenticated adversary can achieve arbitrary command execution on the underlying host system. This capability transforms a standard authentication requirement into a severe compromise vector, as any valid user account becomes a potential entry point for full system takeover.
The operational impact of this vulnerability is profound and extends beyond simple data exposure or service disruption. Successful exploitation allows attackers to execute commands with the same permissions as the LogicalDOC application server process. Depending on how the software is deployed and configured, this could mean running commands as root, SYSTEM, or a dedicated low-privilege user account that still possesses access to sensitive files, databases, and internal network resources. This level of control facilitates further lateral movement within an organization's infrastructure, data exfiltration, installation of persistent backdoors, and potential disruption of critical business operations dependent on the document management system.
This flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the injection of executable code into a context where it is interpreted and run by the server. Furthermore, in terms of tactical mapping to the MITRE ATT&CK framework, this vulnerability supports techniques associated with Command and Scripting Interpreter execution, specifically allowing attackers to leverage system utilities for remote access or persistence. The bypass of security restrictions via denylist evasion also reflects patterns seen in CWE-798 Use of Hard-coded Credentials or CWE-250 Execution with Unnecessary Privileges if the process runs with elevated rights.
Mitigation strategies must prioritize immediate remediation through software updates provided by the vendor, as patches are typically issued to address such critical injection flaws. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict access to the LogicalDOC application interface exclusively to trusted IP ranges and authenticated users with verified need-to-know status. Additionally, input validation mechanisms should be strengthened at the web server or reverse proxy level to block requests containing suspicious Velocity syntax patterns in email-related fields. Regular security audits focusing on template engine configurations and strict adherence to least-privilege principles for service accounts will further reduce the blast radius of any potential exploitation attempts.