Medium severity6.5NVD Advisory· Published Oct 12, 2026
CVE-2026-109202
CVE-2026-109202
Description
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since ZipExport.addFolderDocuments() skips READ and DOWNLOAD permission checks, to download all of its documents in a ZIP archive.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=9.3
Patches
Vulnerability mechanics
References
4- github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/transfer/ZipExport.javanvd
- github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/ExportZip.javanvd
- github.com/logicaldoc/community/commit/648047ee0ec95c294bb983e511fed60dbc67977fnvd
- www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-missing-authorization-via-zip-export-servletnvd
News mentions
0No linked articles in our index yet.