# LogicalDOC Community Edition vulnerabilities Source: https://junglewise.ai/threats/technologies/logicaldoc-community-edition Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/logicaldoc-community-edition.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 10 vulnerabilities in LogicalDOC Community Edition: 0 in the last 7 days and 10 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109206, was published on 12 October 2026. 10 vulnerabilities in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 10 - All time: 10 (0 critical, 0 exploited in the wild) ## About LogicalDOC Community Edition Open-source document management system community edition by LogicalDOC. ## Latest LogicalDOC Community Edition vulnerabilities - [CVE-2026-109206: LogicalDOC Community Edition username enumeration in AvatarServlet](https://junglewise.ai/threats/cve-2026-109206-logicaldoc-community-edition-through-9-3-contains-a-username) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109205: LogicalDOC Community Edition unauthenticated file upload in UploadServlet](https://junglewise.ai/threats/cve-2026-109205-logicaldoc-community-edition-through-9-3-contains-an) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-109204: LogicalDOC Community Edition improper authorization in password recovery](https://junglewise.ai/threats/cve-2026-109204-logicaldoc-community-edition-through-9-3-contains-an-improper) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-109203: LogicalDOC Community Edition missing authorization in ConvertPdf servlet](https://junglewise.ai/threats/cve-2026-109203-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109202: LogicalDOC Community missing authorization in zip-export servlet](https://junglewise.ai/threats/cve-2026-109202-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109201: LogicalDOC Community Edition missing authorization in SOAP document operations](https://junglewise.ai/threats/cve-2026-109201-logicaldoc-community-edition-through-9-3-contains-a-missing) (high, CVSS 8.3, published 12 Oct 2026) - [CVE-2026-109200: LogicalDOC Community Edition server-side request forgery in XMLConverter](https://junglewise.ai/threats/cve-2026-109200-logicaldoc-community-edition-through-9-3-contains-a-server-side) (medium, CVSS 6.4, published 12 Oct 2026) - [CVE-2026-109199: LogicalDOC Community Edition code injection in email templates](https://junglewise.ai/threats/cve-2026-109199-logicaldoc-community-edition-through-9-3-contains-a-code) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109170: LogicalDOC Community Edition HQL injection in DocumentsDataServlet](https://junglewise.ai/threats/cve-2026-109170-logicaldoc-community-edition-through-9-3-contains-an-hql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109169: LogicalDOC Community Edition SQL injection in TagsDataServlet](https://junglewise.ai/threats/cve-2026-109169-logicaldoc-community-edition-through-9-3-contains-a-sql) (medium, CVSS 6.5, published 12 Oct 2026) ## Most severe LogicalDOC Community Edition vulnerabilities - [CVE-2026-109199: LogicalDOC Community Edition code injection in email templates](https://junglewise.ai/threats/cve-2026-109199-logicaldoc-community-edition-through-9-3-contains-a-code) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109201: LogicalDOC Community Edition missing authorization in SOAP document operations](https://junglewise.ai/threats/cve-2026-109201-logicaldoc-community-edition-through-9-3-contains-a-missing) (high, CVSS 8.3, published 12 Oct 2026) - [CVE-2026-109205: LogicalDOC Community Edition unauthenticated file upload in UploadServlet](https://junglewise.ai/threats/cve-2026-109205-logicaldoc-community-edition-through-9-3-contains-an) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-109170: LogicalDOC Community Edition HQL injection in DocumentsDataServlet](https://junglewise.ai/threats/cve-2026-109170-logicaldoc-community-edition-through-9-3-contains-an-hql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109169: LogicalDOC Community Edition SQL injection in TagsDataServlet](https://junglewise.ai/threats/cve-2026-109169-logicaldoc-community-edition-through-9-3-contains-a-sql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109202: LogicalDOC Community missing authorization in zip-export servlet](https://junglewise.ai/threats/cve-2026-109202-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109203: LogicalDOC Community Edition missing authorization in ConvertPdf servlet](https://junglewise.ai/threats/cve-2026-109203-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109200: LogicalDOC Community Edition server-side request forgery in XMLConverter](https://junglewise.ai/threats/cve-2026-109200-logicaldoc-community-edition-through-9-3-contains-a-server-side) (medium, CVSS 6.4, published 12 Oct 2026) - [CVE-2026-109204: LogicalDOC Community Edition improper authorization in password recovery](https://junglewise.ai/threats/cve-2026-109204-logicaldoc-community-edition-through-9-3-contains-an-improper) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-109206: LogicalDOC Community Edition username enumeration in AvatarServlet](https://junglewise.ai/threats/cve-2026-109206-logicaldoc-community-edition-through-9-3-contains-a-username) (medium, CVSS 5.3, published 12 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 10 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other LogicalDOC technologies - [LogicalDOC Enterprise](https://junglewise.ai/threats/technologies/logicaldoc-enterprise): 4 vulnerabilities - [Logicaldoc](https://junglewise.ai/threats/technologies/logicaldoc): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "LogicalDOC Community Edition vulnerabilities", https://junglewise.ai/threats/technologies/logicaldoc-community-edition, 12 November 2026.