Unauthenticated File Upload Vulnerability in LogicalDOC Community Edition
CVE-2026-109205

8.7HIGH

Key Information:

Vendor

Logicaldoc

Status
Logicaldoc Community Edition
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109205?

LogicalDOC Community Edition versions up to 9.3 have a vulnerability that allows attackers to perform unauthenticated file uploads via the UploadServlet endpoint. This can lead to arbitrary file write operations on the server's disk, using multipart requests to exploit the lack of session authentication. The vulnerability enables attackers to persist files in uncleaned temporary directories, potentially exhausting the server's disk space over time.

Affected Version(s)

LogicalDOC Community Edition 0 <= 9.3

References

https://github.com/logicaldoc/community/discussions/119
technical-description
https://github.com/logicaldoc/community/commit/90b7ebea53...
patch
https://github.com/logicaldoc/community/blob/9.3/logicald...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ikram-4
.