Description

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T14:17:10.827Z",
  "pubdate": "2026-10-12T14:17:10.827Z",
  "executiveSummary": "LogicalDOC Community Edition versions up to 9.3 are susceptible to a critical missing authorization vulnerability located within the zip-export servlet.\nThe vulnerability allows an authenticated user to bypass mandatory access control mechanisms, specifically READ and DOWNLOAD permissions, to exfiltrate restricted document repositories.\nBy manipulating the 'folderId' parameter in requests directed at the /zip-export endpoint, an attacker can trigger the server to bundle and export sensitive documents contained within folders for which the attacker lacks appropriate authorization.\nThis represents a significant security oversight where the application fails to validate user permissions at the functional logic layer before processing data retrieval requests.\nThe impact includes unauthorized information disclosure and potential compromise of sensitive organizational assets. While the vulnerability requires a valid user account, it significantly elevates the privileges of any authenticated entity, enabling them to bypass file-level security constraints.\nThere are no requirements for administrative access, only standard authentication, making this a high-risk vector for malicious actors operating within an organization's internal network or via compromised accounts.",
  "technicalDetails": "The vulnerability exists within the 'ZipExport' component of the LogicalDOC Community Edition, specifically affecting the 'addFolderDocuments()' method responsible for compiling documents into a compressed archive for user download.\nThe root cause of the vulnerability is an inadequate implementation of authorization checks during the document export workflow. The application relies on the 'zip-export' servlet to process user-supplied parameters to define the scope of the export operation.\nDuring the execution of 'addFolderDocuments()', the software fails to invoke the mandatory permission verification routines, such as checks for READ or DOWNLOAD access, that are typically enforced throughout other sections of the document management system.\nAn attacker can exploit this by crafting an HTTP request directed at the '/zip-export' URI. By specifying a target 'folderId' corresponding to a restricted or private directory, the attacker forces the servlet to iterate through the contents of that directory.\nBecause the server-side logic skips the necessary authorization gate, the function proceedes to aggregate all documents found within the specified folder ID into a ZIP archive, which is subsequently transmitted to the attacker's client.\nThe attack flow follows a predictable sequence: First, the attacker identifies a valid session via authentication to the platform. Second, the attacker discovers or guesses a 'folderId' that they should be restricted from accessing. Third, the attacker initiates a GET or POST request to '/zip-export' with the target 'folderId' parameter. Finally, the application, failing to validate the user's scope, generates the ZIP package containing the sensitive documents and returns the stream to the attacker.\nThis vulnerability effectively circumvents the security model of the document repository, allowing any authenticated user to perform mass data exfiltration of directories, sub-directories, and files to which they have not been granted access. The exposure is limited to authenticated users; however, the lack of verification means that no privileged escalation is required beyond the initial authentication token."
}