CVE-2026-109199

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109199

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109199.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109199

Published

2026-10-12T13:39:42Z

Modified

2026-10-28T11:06:20Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template

Details

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109199.json"
}

References

Affected packages

Git / github.com/logicaldoc/community

Affected ranges

Type

GIT

Repo

https://github.com/logicaldoc/community

Events

Introduced

Fixed

66c3a6b9b47f9f6c624047eea43b219851378f00

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "9.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "66c3a6b9b47f9f6c624047eea43b219851378f00"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

8.*

8.0

8.4.2

8.5.2

8.6.1

8.7.3

8.8.2

8.8.4

8.8.5

8.9

8.9.1

8.9.2

8.9.3

9.*

9.0

9.1

9.1.1

9.2

9.2.1

9.2.2

9.2.3

9.3

Other

before-jakarta-porting

v8.*

v8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109199.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "194297829142312930299738315161614784950",
            "length": 544
        },
        "id": "CVE-2026-109199-1558b21a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00",
        "target": {
            "file": "logicaldoc-core/src/main/java/com/logicaldoc/core/automation/ClassTool.java",
            "function": "newInstance"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "152484610845182872346761245491328375430",
            "length": 2369
        },
        "id": "CVE-2026-109199-6cff9193",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00",
        "target": {
            "file": "logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java",
            "function": "sendAsEmail"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149593336582050388293376940914226933006",
            "length": 344
        },
        "id": "CVE-2026-109199-8b3e347d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00",
        "target": {
            "file": "logicaldoc-core/src/main/java/com/logicaldoc/core/automation/ClassTool.java",
            "function": "forName"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "256753849013651383982964728030536294055",
                "86088630859698019171462499775507787737",
                "202255790469139696027621279780249740722"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109199-8fe01c69",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00",
        "target": {
            "file": "logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "99510953651107802673668254578817207983",
                "133813343040728830393934197423768956140",
                "287151876493471206061392157001459430692",
                "333014594013216661214556174912412459265",
                "207633197987426631483492460213842065772",
                "134324202251426032179418889725705664665",
                "187397852322050394707890168104737424070",
                "331514179944249622438500285539796154820",
                "137926166451512235238837155289623878595",
                "149022702559841328293250744549586904016",
                "337326475411313020278149172448910430385",
                "149671558752972752670892578655339691637",
                "191065098898340588042234109127517375178"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-109199-93df3a19",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00",
        "target": {
            "file": "logicaldoc-core/src/main/java/com/logicaldoc/core/automation/ClassTool.java"
        }
    }
]

vanir_signatures_modified

"2026-10-28T11:06:20Z"