CVE-2026-109199: LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated LogicalDOC Community Edition user can exploit it. The attack does not require user interaction and can be performed remotely over the network.
What access and input are required for exploitation?
The attacker needs access to DocumentService.sendAsEmail and must be able to submit a Velocity template in the email subject or message field. Malicious templates can invoke SystemTool exec methods or ClassTool to execute operating-system commands.
What level of impact can successful exploitation have?
Commands execute with the privileges of the LogicalDOC process. This can compromise confidentiality, integrity, and availability of resources accessible to that process.
Are denylist-based Velocity restrictions sufficient mitigation?
No. The described attack bypasses the forbidRuntimeUsage denylist. The provided data identifies affected LogicalDOC Community Edition versions through 9.3 and references a remediation commit, but does not specify a fixed release version.