High severity7.5NVD Advisory· Published Oct 12, 2026
CVE-2026-109205
CVE-2026-109205
Description
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.
Affected products
1- Range: <=9.3
Patches
Vulnerability mechanics
References
3- github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/UploadServlet.javanvd
- github.com/logicaldoc/community/commit/90b7ebea5330feab94aff5ef0573362f3e52a1ccnvd
- www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-unauthenticated-upload-disk-exhaustion-via-uploadservletnvd
News mentions
0No linked articles in our index yet.