{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/logicaldoc/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:logicaldoc:logicaldoc:*:*:*:*:community:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-109199"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LogicalDOC Community Edition (\u003c= 9.3)"],"_cs_severities":["high"],"_cs_tags":["remote-code-execution","injection","vulnerability","web-vulnerability","authorization-bypass","cve-2026-109201"],"_cs_type":"advisory","_cs_vendors":["LogicalDOC"],"content_html":"\u003cp\u003eLogicalDOC Community Edition through version 9.3 contains a critical code injection vulnerability (CVE-2026-109199) that allows authenticated users to execute arbitrary operating system commands. The vulnerability exists within the 'DocumentService.sendAsEmail' function, which processes user-supplied input for the subject and message fields using the Apache Velocity template engine.\u003c/p\u003e\n\u003cp\u003eAttackers can leverage this input to submit malicious Velocity templates that invoke sensitive Java classes, specifically 'SystemTool' or 'ClassTool'. These methods allow for the execution of system commands, effectively bypassing the 'forbidRuntimeUsage' denylist implemented by the application. Because the commands are executed with the privileges of the LogicalDOC service process, successful exploitation results in full remote code execution on the underlying host, potentially leading to total system compromise. This vulnerability requires an authenticated session, making it a significant risk for organizations using LogicalDOC in internal or public-facing environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the LogicalDOC web interface with valid user credentials.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the email functionality provided by the 'DocumentService' component.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a request targeting the 'sendAsEmail' operation.\u003c/li\u003e\n\u003cli\u003eAttacker injects a malicious Velocity template payload into the 'subject' or 'message' parameters.\u003c/li\u003e\n\u003cli\u003eAttacker embeds calls to 'SystemTool.exec()' or 'ClassTool' within the template to bypass 'forbidRuntimeUsage' filters.\u003c/li\u003e\n\u003cli\u003eThe application server parses the malicious template during the email generation process.\u003c/li\u003e\n\u003cli\u003eThe Java Virtual Machine executes the injected OS commands with the permissions of the web application user.\u003c/li\u003e\n\u003cli\u003eAttacker achieves remote code execution, enabling further lateral movement or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-109199 allows an authenticated attacker to execute arbitrary commands on the application server. This can result in complete system compromise, unauthorized access to sensitive documents managed by LogicalDOC, and lateral movement within the network. The scope of impact includes any infrastructure running LogicalDOC Community Edition version 9.3 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify and restrict access to the 'DocumentService' endpoints for users who do not require email functionality.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to inspect POST requests to the 'DocumentService' for Velocity template syntax, such as '$class.inspect', 'SystemTool', or 'ClassTool'.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious payload patterns in 'subject' or 'message' fields associated with the 'sendAsEmail' method.\u003c/li\u003e\n\u003cli\u003ePatch LogicalDOC Community Edition to the latest available version once a security update addressing CVE-2026-109199 is released by LogicalDOC.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T15:43:04Z","date_published":"2026-10-12T15:42:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-logicaldoc-code-injection/","summary":"LogicalDOC Community Edition versions 9.3 and earlier are vulnerable to authenticated OS command injection via maliciously crafted Velocity templates within the DocumentService.sendAsEmail function.","title":"Authenticated OS Command Injection in LogicalDOC Community Edition","url":"https://feed.craftedsignal.io/briefs/2026-10-logicaldoc-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - LogicalDOC","version":"https://jsonfeed.org/version/1.1"}