CVE-2026-109170

EUVD-2026-97447
LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/logicaldoc/community
https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/DocumentsDataServlet.java#L443
https://github.com/logicaldoc/community/commit/c3bbfd4641f1cd2b340f114ea198d3f65b6581ee
https://github.com/logicaldoc/community/discussions/119
https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-hql-injection-via-documents-xml-indexed-parameter