Description

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T14:17:10.373Z",
  "pubdate": "2026-10-12T14:17:10.373Z",
  "executiveSummary": "LogicalDOC Community Edition through version 9.3 is susceptible to a critical code injection vulnerability resulting from the improper handling of Velocity templates within the DocumentService component.\nThis vulnerability allows an authenticated attacker to perform remote code execution (RCE) by injecting malicious Velocity directives into the 'subject' or 'message' parameters of the 'sendAsEmail' method.\nBy manipulating these fields, an attacker can circumvent existing security filters, such as the 'forbidRuntimeUsage' denylist, to instantiate system objects and execute arbitrary OS commands.\nThe commands are executed with the security context and privileges of the LogicalDOC process, which may lead to full system compromise, unauthorized data exfiltration, or lateral movement within the host network.\nExploitation requires a valid user account, which limits the initial attack surface, but significantly increases the risk for environments where internal user access is broad or compromised credentials are used.\nThere are currently no provided patches, necessitating immediate administrative focus on input validation and restriction of access to the DocumentService API for untrusted users.",
  "technicalDetails": "The vulnerability resides in the DocumentService component of LogicalDOC Community Edition, specifically within the logic that processes 'sendAsEmail' requests. The application improperly evaluates user-supplied input from the 'subject' and 'message' fields using the Apache Velocity template engine.\nThe root cause is the failure to properly sanitize or restrict the execution context of Velocity templates provided by users. Although LogicalDOC implements a 'forbidRuntimeUsage' denylist intended to prevent access to dangerous Java classes and methods, the implementation is insufficient against sophisticated template injection techniques.\nAn attacker can exploit this by crafting a malicious payload that leverages permitted classes to reach restricted methods. Specifically, the attacker can utilize 'SystemTool' or 'ClassTool' to instantiate objects that provide a bridge to the Java runtime environment.\nThe attack flow proceeds as follows: 1) The authenticated attacker initiates a request to the 'DocumentService.sendAsEmail' endpoint. 2) The attacker injects a Velocity template payload into the 'subject' or 'message' parameters, such as #set($x = $class.inspect('java.lang.Runtime').type.getRuntime().exec('id')). 3) The template engine parses the directive, bypassing the denylist check, and evaluates the expression during the email generation process. 4) The server-side Java process executes the command defined in the 'exec' method, resulting in code execution at the OS level.\nBecause the execution is performed by the process running the LogicalDOC application, the attacker inherits the system permissions assigned to that service account. This allows for arbitrary command execution, such as reading configuration files containing database credentials, installing web shells, or interacting with the underlying operating system.\nThe flaw affects all versions of LogicalDOC Community Edition up to and including 9.3. Successful exploitation is contingent upon active authentication, but it does not require additional complex configuration or interaction from high-privileged users once the initial authenticated session is established. The lack of robust sandboxing for user-controlled templates remains the primary technical failure."
}