CVE-2026-109169: LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from lduser.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated LogicalDOC Community Edition account. The issue is exploitable by low-privileged users, so administrative access is not required.
What information could be exposed?
A successful UNION SELECT injection can return data through the XML tag list, including usernames, email addresses, and password hashes from the ld_user table.
Which deployments are affected?
LogicalDOC Community Edition through version 9.3 is affected. The vulnerable input is the firstLetter parameter handled by TagsDataServlet.
How can defenders look for exploitation?
Review requests to TagsDataServlet and associated tags.xml endpoints for unusual firstLetter parameter values, particularly SQL syntax or UNION SELECT expressions. Also investigate unexpected access to XML tag-list responses by low-privileged accounts.