CVE-2026-109203highCWE-862

CVE-2026-109203: falha de alta gravidade em LogicalDOC Community Edition

LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar LogicalDOC Community Edition

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.2%
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use the version parameter to retrieve any PDF and its versions from folders they cannot access.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
LogicalDOC · LogicalDOC Community Edition
CVEs relacionadas — LogicalDOC Community Edition

No mesmo produto, das mais perigosas para as menos.

CVE-2022-47418MEDIUMLogicalDOC Document Version Comment Stored XSSEPSS 0.5%CVE-2022-47417MEDIUMLogicalDOC Document File Name Stored XSSEPSS 0.5%CVE-2022-47415MEDIUMLogicalDOC Messaging Stored XSSEPSS 0.5%CVE-2026-109205HIGHLogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServletEPSS 0.4%CVE-2026-109199HIGHLogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail TemplateEPSS 0.4%CVE-2026-109170HIGHLogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed ParameterEPSS 0.3%