Is CVE-2026-109205 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109205 being exploited in the wild.

How severe is CVE-2026-109205?

High severity, with a CVSS score of 7.5, published 12 October 2026.

Which products and versions are affected?

LogicalDOC Community Edition through 9.3.

Is there a fix for CVE-2026-109205?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-109205 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109205?

Check whether you run LogicalDOC Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109205: LogicalDOC Community Edition unauthenticated file upload in UploadServlet

CVE-2026-109205 · Severity: high · CVSS 7.5 · Published 2026-10-12

LogicalDOC Community Edition is an open-source document management system. The application contains an unauthenticated file upload vulnerability in the UploadServlet endpoint that allows attackers to write files to the server without logging in. An attacker can send repeated multipart requests to exhaust disk space or persist malicious files, potentially leading to denial of service or code execution.

Technologies: LogicalDOC Community Edition. Vendors: LogicalDOC.

Quick answers

Is CVE-2026-109205 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109205 being exploited in the wild.
How severe is CVE-2026-109205?: High severity, with a CVSS score of 7.5, published 12 October 2026.
Which products and versions are affected?: LogicalDOC Community Edition through 9.3.
Is there a fix for CVE-2026-109205?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-109205 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109205?: Check whether you run LogicalDOC Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The UploadServlet endpoint lacks authentication checks, allowing unauthenticated HTTP multipart requests to the /upload path to write files to disk. Attackers can repeatedly submit requests with unlimited file parts to exhaust server storage in uncleaned temporary directories. The vulnerability is a combination of missing authentication and lack of resource limits on file uploads.

Affected products

LogicalDOC Community Edition through 9.3

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.