CVE-2026-109202: LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated LogicalDOC Community Edition user who can send a request to the zip-export endpoint can attempt exploitation. The attacker needs to know or obtain the numeric folderId of a restricted folder.
What access does an attacker gain?
The attacker can download all documents in the targeted restricted folder as a ZIP archive. The issue affects confidentiality; the provided data does not indicate integrity or availability impact.
Are restricted folders protected by the normal permission model when exported as ZIP files?
No. The vulnerable zip-export path skips READ and DOWNLOAD permission checks in ZipExport.addFolderDocuments(), allowing a supplied restricted folderId to bypass those restrictions.
How can administrators determine whether they are affected?
LogicalDOC Community Edition versions through 9.3 are affected. Review access and request logs for requests to /zip-export containing folderId values, especially where the requesting user would not normally have READ or DOWNLOAD access to that folder.