CVE-2026-109169: Logicaldoc Community Edition

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.

Affected products

• Logicaldoc Logicaldoc Community Edition: up to and including 9.3

Published 2026-10-12. Last modified 2026-10-13.