CVE-2026-109205 in Community Edition
Summary
by MITRE • 10/12/2026
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The logical flaw within LogicalDOC Community Edition versions up through 9.3 presents a critical security risk centered on the UploadServlet component. This vulnerability stems from an insufficient authentication check that permits remote attackers to interact with file upload functionality without establishing a valid user session. In secure enterprise document management systems, the ability to upload files is typically gated behind strict access controls and active sessions to ensure accountability and prevent abuse. The absence of this requirement in the UploadServlet creates a direct pathway for unauthorized actors to bypass standard security boundaries, effectively treating an authenticated operation as if it were public or anonymous.
The technical mechanism of exploitation involves sending multipart HTTP requests directly to the upload endpoint without providing valid authentication credentials. Because the server fails to validate the session state before processing these uploads, attackers can persist arbitrary files onto the underlying file system. These files are stored in temporary directories that are not properly cleaned up after use or during failed operations. This lack of cleanup is a secondary but significant flaw that exacerbates the impact of the initial unauthorized access. The combination of unauthenticated writes and persistent storage in volatile locations allows attackers to maintain a foothold on the server even if subsequent requests fail, as previously uploaded files remain on disk.
The operational impact of this vulnerability extends beyond simple data integrity concerns into severe availability issues through resource exhaustion attacks. Attackers can exploit the unlimited nature of file parts by repeatedly sending multipart requests with large or numerous attachments. Since there are no effective rate limits or size constraints enforced at the application level for these unauthenticated uploads, a single attacker can rapidly consume available disk space on the server. This denial-of-service condition renders the document management system unusable for legitimate users and may require manual intervention to clear temporary directories and restore service availability. The persistence of files in unclosed temporary folders means that even if the immediate upload process is interrupted, the consumed resources are not reclaimed automatically.
From a classification perspective, this vulnerability aligns with CWE-434, which describes the unrestricted uploading of dangerous file types, although here it is compounded by CWE-287 regarding improper authentication and CWE-519 concerning access control failures. The exploitation technique maps to MITRE ATT&CK techniques related to Initial Access via web applications and potentially Persistence if attackers utilize the uploaded files for further malicious activities such as deploying backdoors or scripts. While the primary described impact is resource exhaustion, the ability to write arbitrary files to disk opens additional vectors for remote code execution depending on server configuration and file interpretation capabilities by other services running on the host system.
Mitigation strategies must address both the authentication gap and the resource management flaws. The most effective immediate remediation involves applying vendor-provided patches that enforce strict session validation within the UploadServlet before processing any upload requests. If patching is not immediately feasible, network-level controls such as web application firewalls can be configured to block multipart uploads from unauthenticated sources or to limit request rates for specific endpoints. Additionally, system administrators should implement file size limits and timeout mechanisms at both the application server level and the operating system level to mitigate resource exhaustion risks. Regular auditing of temporary directories and automated cleanup scripts can also help reduce the impact of any residual vulnerabilities by ensuring that orphaned files do not accumulate over time.