CVE-2026-109170
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-89
Impact
Authenticated attackers with read access to any folder can bypass permission checks to access restricted document metadata and dump database contents. They need network access and valid user credentials to exploit this.
Root cause
The DocumentsDataServlet directly concatenates the unvalidated 'indexed' HTTP parameter into an HQL query.
Affected systems
LogicalDOC Community Edition through 9.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Fix & remediation
Upgrade to a version past 9.3 or cherry-pick commit c3bbfd4641f1cd2b340f114ea198d3f65b6581ee. If patching immediately is not possible, restrict untrusted user access to the web interface or block requests to DocumentsDataServlet carrying an 'indexed' parameter at your reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
References
- https://github.com/logicaldoc/community
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/DocumentsDataServlet.java#L443
- https://github.com/logicaldoc/community/commit/c3bbfd4641f1cd2b340f114ea198d3f65b6581ee
- https://github.com/logicaldoc/community/discussions/119
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-hql-injection-via-documents-xml-indexed-parameter