# CVE-2026-109170: LogicalDOC Community Edition HQL injection in DocumentsDataServlet

Source: https://junglewise.ai/threats/cve-2026-109170-logicaldoc-community-edition-through-9-3-contains-an-hql  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-12. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-109170 · Severity: medium · CVSS 6.5 · Published 2026-10-12

LogicalDOC Community Edition is an open-source document management system. An authenticated user can inject malicious code into search queries to bypass folder access controls and read restricted documents and database contents without authorization. This allows users with minimal read permissions to extract sensitive information across the entire document repository.

Technologies: [LogicalDOC Community Edition](https://junglewise.ai/threats/technologies/logicaldoc-community-edition). Vendors: [LogicalDOC](https://junglewise.ai/threats/vendors/logicaldoc).

## Quick answers

**Is CVE-2026-109170 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-109170 being exploited in the wild.

**How severe is CVE-2026-109170?** Medium severity, with a CVSS score of 6.5, published 12 October 2026.

**Which products and versions are affected?** LogicalDOC Community Edition through 9.3.

**Is there a fix for CVE-2026-109170?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-109170 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-109170?** Check whether you run LogicalDOC Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DocumentsDataServlet in LogicalDOC Community Edition through version 9.3 fails to validate the "indexed" parameter before using it in HQL (Hibernate Query Language) queries. An authenticated attacker can inject boolean HQL expressions to manipulate query logic, circumvent folder scope checks and permission validation, and retrieve restricted document metadata and database records. The vulnerability requires valid authentication but no special privileges beyond basic read access.

## Affected products

- LogicalDOC Community Edition through 9.3

## Timeline

- 2026-10-12: disclosed

## References

- [https://github.com/logicaldoc/community](https://github.com/logicaldoc/community)
- [https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/DocumentsDataServlet.java](https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/DocumentsDataServlet.java)

## Related threats

- [LogicalDOC Community Edition username enumeration in AvatarServlet](https://junglewise.ai/threats/cve-2026-109206-logicaldoc-community-edition-through-9-3-contains-a-username)
- [LogicalDOC Community Edition unauthenticated file upload in UploadServlet](https://junglewise.ai/threats/cve-2026-109205-logicaldoc-community-edition-through-9-3-contains-an)
- [LogicalDOC Community Edition improper authorization in password recovery](https://junglewise.ai/threats/cve-2026-109204-logicaldoc-community-edition-through-9-3-contains-an-improper)
- [LogicalDOC Community Edition missing authorization in ConvertPdf servlet](https://junglewise.ai/threats/cve-2026-109203-logicaldoc-community-edition-through-9-3-contains-a-missing)
- [LogicalDOC Community missing authorization in zip-export servlet](https://junglewise.ai/threats/cve-2026-109202-logicaldoc-community-edition-through-9-3-contains-a-missing)