CVE-2026-109169highCWE-89

CVE-2026-109169: fallo de gravedad alta en LogicalDOC Community Edition

LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

Publicada el · Actualizada el

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.3%
probabilidad de explotación
0.3%top 82% de las CVE
explotación observada
noninguna fuente lo reporta
LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
LogicalDOC · LogicalDOC Community Edition
CVEs relacionadas — LogicalDOC Community Edition

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-47418MEDIUMLogicalDOC Document Version Comment Stored XSSEPSS 0.5%CVE-2022-47417MEDIUMLogicalDOC Document File Name Stored XSSEPSS 0.5%CVE-2022-47415MEDIUMLogicalDOC Messaging Stored XSSEPSS 0.5%CVE-2026-109205HIGHLogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServletEPSS 0.4%CVE-2026-109199HIGHLogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail TemplateEPSS 0.4%CVE-2026-109170HIGHLogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed ParameterEPSS 0.3%
Referencias
https://github.com/logicaldoc/communityhttps://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/document/HibernateDocumentDAO.java#L691https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/TagsDataServlet.java#L41https://github.com/logicaldoc/community/commit/8428bfb93f89ab5773019299d17d643c075c4aeehttps://github.com/logicaldoc/community/discussions/119https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-sql-injection-via-tags-xml-firstletter