CVE-2026-109203: LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated LogicalDOC Community Edition user can exploit it. The attacker does not need access to the folder containing the target document.
What does an attacker need to retrieve restricted documents?
The attacker needs to enumerate sequential docId values and supply the version parameter. This can be used to download a PDF document and its available versions.
Is this limited to current document versions?
No. The vulnerability permits retrieval of PDFs and their versions, so historical versions may also be exposed.
Which deployments are known to be affected?
LogicalDOC Community Edition through version 9.3 is affected.