GHSA-cfx3-f25c-pr5cHighCVSS 6.5
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-109169
- https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aee
- https://github.com/logicaldoc/community
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41
- https://github.com/logicaldoc/community/discussions/119
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via-tags-xml-firstletter
- https://github.com/advisories/GHSA-cfx3-f25c-pr5c