# LogicalDOC vulnerabilities Source: https://junglewise.ai/threats/vendors/logicaldoc Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/logicaldoc.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 17 vulnerabilities in LogicalDOC: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-109206, was published on 12 October 2026. 10 vulnerabilities in the last four weeks, up 900% on the four before (1). 3 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 11 - All time: 17 (0 critical, 0 exploited in the wild) ## About LogicalDOC LogicalDOC is a software company specializing in document management solutions and enterprise content management. ## Latest LogicalDOC vulnerabilities - [CVE-2026-109206: LogicalDOC Community Edition username enumeration in AvatarServlet](https://junglewise.ai/threats/cve-2026-109206-logicaldoc-community-edition-through-9-3-contains-a-username) (medium, CVSS 5.3, published 12 Oct 2026) - [CVE-2026-109205: LogicalDOC Community Edition unauthenticated file upload in UploadServlet](https://junglewise.ai/threats/cve-2026-109205-logicaldoc-community-edition-through-9-3-contains-an) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-109204: LogicalDOC Community Edition improper authorization in password recovery](https://junglewise.ai/threats/cve-2026-109204-logicaldoc-community-edition-through-9-3-contains-an-improper) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-109203: LogicalDOC Community Edition missing authorization in ConvertPdf servlet](https://junglewise.ai/threats/cve-2026-109203-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109202: LogicalDOC Community missing authorization in zip-export servlet](https://junglewise.ai/threats/cve-2026-109202-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109201: LogicalDOC Community Edition missing authorization in SOAP document operations](https://junglewise.ai/threats/cve-2026-109201-logicaldoc-community-edition-through-9-3-contains-a-missing) (high, CVSS 8.3, published 12 Oct 2026) - [CVE-2026-109200: LogicalDOC Community Edition server-side request forgery in XMLConverter](https://junglewise.ai/threats/cve-2026-109200-logicaldoc-community-edition-through-9-3-contains-a-server-side) (medium, CVSS 6.4, published 12 Oct 2026) - [CVE-2026-109199: LogicalDOC Community Edition code injection in email templates](https://junglewise.ai/threats/cve-2026-109199-logicaldoc-community-edition-through-9-3-contains-a-code) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109170: LogicalDOC Community Edition HQL injection in DocumentsDataServlet](https://junglewise.ai/threats/cve-2026-109170-logicaldoc-community-edition-through-9-3-contains-an-hql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109169: LogicalDOC Community Edition SQL injection in TagsDataServlet](https://junglewise.ai/threats/cve-2026-109169-logicaldoc-community-edition-through-9-3-contains-a-sql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2025-45871: LogicalDOC Enterprise blind SQL injection in WorkflowsDataServlet](https://junglewise.ai/threats/cve-2025-45871-logicaldoc-enterprise-up-to-and-for-9-1-1-is-vulnerable-to-blind) (info, published 6 Oct 2026) - [CVE-2025-45870: LogicalDOC Enterprise Local File Inclusion in OnlyOfficeEditor](https://junglewise.ai/threats/cve-2025-45870-logicaldoc-enterprise-local-file-inclusion-in-onlyofficeeditor) (info, CVSS 6.5, published 16 Jul 2026) - [CVE-2025-45868: LogicalDOC Enterprise blind SQL injection in ComparisonServlet](https://junglewise.ai/threats/cve-2025-45868-logicaldoc-enterprise-blind-sql-injection-in-comparisonservlet) (info, CVSS 6.5, published 16 Jul 2026) - [CVE-2025-45869: LogicalDOC Enterprise SSRF in ShareFileCallback servlet](https://junglewise.ai/threats/cve-2025-45869-logicaldoc-enterprise-ssrf-in-sharefilecallback-servlet) (info, CVSS 0, published 13 Jul 2026) - [CVE-2025-12547: A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of…](https://junglewise.ai/threats/cve-2025-12547-a-vulnerability-was-identified-in-logicaldoc-community-edition-up) (low, CVSS 3.7, published 31 Oct 2025) - [CVE-2025-12546: A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the…](https://junglewise.ai/threats/cve-2025-12546-a-vulnerability-was-determined-in-logicaldoc-community-edition-up) (low, CVSS 3.5, published 31 Oct 2025) - [CVE-2025-11946: A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1. This issue affects some unknown…](https://junglewise.ai/threats/cve-2025-11946-a-security-flaw-has-been-discovered-in-logicaldoc-community) (low, CVSS 3.5, published 19 Oct 2025) ## Most severe LogicalDOC vulnerabilities - [CVE-2026-109199: LogicalDOC Community Edition code injection in email templates](https://junglewise.ai/threats/cve-2026-109199-logicaldoc-community-edition-through-9-3-contains-a-code) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109201: LogicalDOC Community Edition missing authorization in SOAP document operations](https://junglewise.ai/threats/cve-2026-109201-logicaldoc-community-edition-through-9-3-contains-a-missing) (high, CVSS 8.3, published 12 Oct 2026) - [CVE-2026-109205: LogicalDOC Community Edition unauthenticated file upload in UploadServlet](https://junglewise.ai/threats/cve-2026-109205-logicaldoc-community-edition-through-9-3-contains-an) (high, CVSS 7.5, published 12 Oct 2026) - [CVE-2026-109170: LogicalDOC Community Edition HQL injection in DocumentsDataServlet](https://junglewise.ai/threats/cve-2026-109170-logicaldoc-community-edition-through-9-3-contains-an-hql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109169: LogicalDOC Community Edition SQL injection in TagsDataServlet](https://junglewise.ai/threats/cve-2026-109169-logicaldoc-community-edition-through-9-3-contains-a-sql) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109202: LogicalDOC Community missing authorization in zip-export servlet](https://junglewise.ai/threats/cve-2026-109202-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109203: LogicalDOC Community Edition missing authorization in ConvertPdf servlet](https://junglewise.ai/threats/cve-2026-109203-logicaldoc-community-edition-through-9-3-contains-a-missing) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109200: LogicalDOC Community Edition server-side request forgery in XMLConverter](https://junglewise.ai/threats/cve-2026-109200-logicaldoc-community-edition-through-9-3-contains-a-server-side) (medium, CVSS 6.4, published 12 Oct 2026) - [CVE-2026-109204: LogicalDOC Community Edition improper authorization in password recovery](https://junglewise.ai/threats/cve-2026-109204-logicaldoc-community-edition-through-9-3-contains-an-improper) (medium, CVSS 6.3, published 12 Oct 2026) - [CVE-2026-109206: LogicalDOC Community Edition username enumeration in AvatarServlet](https://junglewise.ai/threats/cve-2026-109206-logicaldoc-community-edition-through-9-3-contains-a-username) (medium, CVSS 5.3, published 12 Oct 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 900% on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 10 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## LogicalDOC technologies - [LogicalDOC Community Edition](https://junglewise.ai/threats/technologies/logicaldoc-community-edition): 10 vulnerabilities - [LogicalDOC Enterprise](https://junglewise.ai/threats/technologies/logicaldoc-enterprise): 4 vulnerabilities - [Logicaldoc](https://junglewise.ai/threats/technologies/logicaldoc): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "LogicalDOC vulnerabilities", https://junglewise.ai/threats/vendors/logicaldoc, 12 November 2026.