Description

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T14:17:11.277Z",
  "pubdate": "2026-10-12T14:17:11.277Z",
  "executiveSummary": "LogicalDOC Community Edition through version 9.3 is susceptible to an unauthenticated arbitrary file upload vulnerability located within the /upload endpoint. The vulnerability resides in the UploadServlet, which fails to enforce session validation, allowing remote, unauthenticated actors to transmit multipart requests containing arbitrary file data.\nThe primary risk implication involves an unconstrained write-to-disk capability. By repeatedly transmitting requests with unlimited file parts, an attacker can persistently write files into the server's temporary storage directories. Because these files are not automatically purged or cleaned by the application, this vulnerability facilitates a Denial of Service (DoS) vector through rapid disk space exhaustion. This flaw exposes the host system to infrastructure-level instability, potentially rendering the LogicalDOC instance and other services on the same filesystem unresponsive. There are no authentication or privilege requirements for exploitation, making this a high-impact risk for publicly exposed installations.",
  "technicalDetails": "The vulnerability is localized within the UploadServlet component of the LogicalDOC Community Edition application, specifically affecting all versions up to and including 9.3. The root cause of the vulnerability is an insufficient access control implementation that fails to perform mandatory session verification prior to processing incoming multipart HTTP requests.\nUnder normal operating conditions, an application servlet responsible for handling file uploads should validate the identity and authorization context of the user before committing any data to the underlying storage layer. In this instance, the UploadServlet accepts POST requests to the /upload URI without verifying a valid session token, thereby treating unauthenticated HTTP traffic as a legitimate file processing request.\nThe exploitation flow is straightforward: an attacker constructs a malicious multipart/form-data request and directs it to the /upload endpoint. Because the servlet lacks authentication gates, it proceeds to parse the request and map the incoming file data into a temporary storage directory defined by the application's configuration. The vulnerability is compounded by the application's design, which allows for the inclusion of multiple file parts within a single request, or the rapid-fire transmission of multiple requests, without imposing rate limits or resource quotas on these temporary uploads.\nThe post-exploitation behavior primarily centers on resource exhaustion. As the server writes these arbitrary files to disk, the operating system's partition hosting the temporary directory experiences rapid storage degradation. The application does not implement a post-process cleanup or a temporal deletion mechanism for these files, causing them to accumulate persistently. Eventually, the storage volume reaches maximum capacity, leading to a system-wide Denial of Service. This impacts not only the functionality of the LogicalDOC application—which will fail to save subsequent files or perform operations requiring temporary space—but potentially interrupts the underlying operating system and any co-located services competing for the same disk resources.\nBecause the servlet processes the data indiscriminately, an attacker can continue to consume disk resources until the storage volume is entirely exhausted, requiring manual intervention by administrators to identify and remove the spurious file fragments, effectively restoring system integrity through manual administrative remediation."
}