CVE-2025-11946
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
A security flaw was discovered in LogicalDOC Community Edition up to 9.2.1 affecting /frontend.jsp in the Add Contact Page component. Manipulation of First Name/Last Name/Company/Address/Phone/Mobile arguments results in cross site scripting, and the exploit has been publicly released.
Risk Assessment
A remote attacker can execute malicious script in a victim's browser, potentially hijacking sessions or credentials. Since the exploit is public, the risk of rapid exploitation is high.
Recommendation
Update LogicalDOC to a version later than 9.2.1 once the vendor releases a fix. Until then, restrict access to the interface and enforce server-side input validation.
Other vulnerabilities in LogicalDOC Community Edition
See all- CVE-2017-1000022High
LogicalDoc Community Edition 7.5.3 and prior contain an incorrect access control which could lead to privilege escalation.
- CVE-2017-1000021High
LogicalDoc Community Edition version 7.5.3 and prior is vulnerable to XXE when indexing XML documents.
- CVE-2026-109205High
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
- CVE-2026-109201High
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.
- CVE-2026-109199High
LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.
- CVE-2025-12546Low
LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.
Original NVD description (English source)
A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown processing of the file /frontend.jsp of the component Add Contact Page. Performing manipulation of the argument First Name/Last Name/Company/Address/Phone/Mobile results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS