---
id: CVE-2026-109199
title: >-
  LogicalDOC Community Edition through 9.3 contains a code injection
  vulnerability that allows authenticated users to execute OS commands by
  submitting Velocity templates in DocumentService.sendAsEmail subject or
  message fields
summary: >-
  LogicalDOC Community Edition through 9.3 contains a code injection
  vulnerability that allows authenticated users to execute OS commands by
  submitting Velocity templates in DocumentService.sendAsEmail subject or
  message fields. Attackers …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T14:17:10.373'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109199'
references:
  - url: 'https://github.com/logicaldoc/community'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/automation/SystemTool.java#L59
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/service/DocumentServiceImpl.java#L1543
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/logicaldoc/community/commit/66c3a6b9b47f9f6c624047eea43b219851378f00
    label: disclosure@vulncheck.com
  - url: 'https://github.com/logicaldoc/community/discussions/119'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-code-injection-via-velocity-sendasemail-template
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.118Z'
---

## Overview

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.