CVE-2026-109170: LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have read access to at least one folder. From that position, they can use the vulnerable indexed parameter to bypass folder-scope and read-permission checks.
What information could an attacker obtain?
The issue can expose restricted document metadata and allow extraction of database contents. The reported impact is confidentiality-focused; no integrity or availability impact is specified.
Which deployments are affected?
LogicalDOC Community Edition through version 9.3 is affected. The vulnerable code path is DocumentsDataServlet processing of the documents.xml indexed parameter.