Authenticated OS Command Injection in LogicalDOC Community Edition

LogicalDOC Community Edition through version 9.3 contains a critical code injection vulnerability (CVE-2026-109199) that allows authenticated users to execute arbitrary operating system commands. The vulnerability exists within the 'DocumentService.sendAsEmail' function, which processes user-supplied input for the subject and message fields using the Apache Velocity template engine.

Attackers can leverage this input to submit malicious Velocity templates that invoke sensitive Java classes, specifically 'SystemTool' or 'ClassTool'. These methods allow for the execution of system commands, effectively bypassing the 'forbidRuntimeUsage' denylist implemented by the application. Because the commands are executed with the privileges of the LogicalDOC service process, successful exploitation results in full remote code execution on the underlying host, potentially leading to total system compromise. This vulnerability requires an authenticated session, making it a significant risk for organizations using LogicalDOC in internal or public-facing environments.

Attack Chain

1. Attacker authenticates to the LogicalDOC web interface with valid user credentials.
2. Attacker navigates to the email functionality provided by the 'DocumentService' component.
3. Attacker crafts a request targeting the 'sendAsEmail' operation.
4. Attacker injects a malicious Velocity template payload into the 'subject' or 'message' parameters.
5. Attacker embeds calls to 'SystemTool.exec()' or 'ClassTool' within the template to bypass 'forbidRuntimeUsage' filters.
6. The application server parses the malicious template during the email generation process.
7. The Java Virtual Machine executes the injected OS commands with the permissions of the web application user.
8. Attacker achieves remote code execution, enabling further lateral movement or data exfiltration.

Impact

Successful exploitation of CVE-2026-109199 allows an authenticated attacker to execute arbitrary commands on the application server. This can result in complete system compromise, unauthorized access to sensitive documents managed by LogicalDOC, and lateral movement within the network. The scope of impact includes any infrastructure running LogicalDOC Community Edition version 9.3 or earlier.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Identify and restrict access to the 'DocumentService' endpoints for users who do not require email functionality.
• Implement Web Application Firewall (WAF) rules to inspect POST requests to the 'DocumentService' for Velocity template syntax, such as '$class.inspect', 'SystemTool', or 'ClassTool'.
• Monitor web server logs for suspicious payload patterns in 'subject' or 'message' fields associated with the 'sendAsEmail' method.
• Patch LogicalDOC Community Edition to the latest available version once a security update addressing CVE-2026-109199 is released by LogicalDOC.