Logicaldoc develops a document-management platform that sits within enterprise content repositories and collaborative workflows, making its security posture relevant across organizations that rely on centralized document storage and access control. Its vulnerability profile recurs consistently around input-handling and access-control weaknesses—cross-site scripting, code injection, path traversal, SQL injection, and rate-limiting gaps—that are characteristic of web-facing document platforms where user input flows into code generation, database queries, and file-system operations. A meaningful share of vulnerabilities reaching this vendor escalate to critical severity, reflecting the potential for attackers to move from input injection into system compromise or data exfiltration in a document-management context. Defenders should prioritize patching this vendor's releases and ensure deployment instances are access-restricted; current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Logicaldoc over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-9423CRITICAL LogicalDoc before 8.3.3 could allow an attacker to upload arbitrary files, leading to command execution or retrieval of data from the database. LogicalDoc provides a functionality | Mar 18, 2020 | 9.8 | 26 | NO | NO |
CVE-2025-12547HIGH A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Admin Login Page. Such m | Oct 31, 2025 | 8.1 | 25 | NO | NO |
CVE-2019-25258HIGH LogicalDOC Enterprise 7.7.4 contains multiple post-authentication file disclosure vulnerabilities that allow attackers to read arbitrary files through unverified 'suffix' and 'file | Dec 24, 2025 | 7.5 | 24 | NO | NO |
CVE-2024-54449HIGH The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an a | Mar 14, 2025 | 8.8 | 24 | NO | NO |
CVE-2020-10366HIGH LogicalDoc before 8.3.3 allows /servlet.gupld Directory Traversal, a different vulnerability than CVE-2020-9423 and CVE-2020-10365. | Apr 8, 2020 | 7.5 | 24 | NO | NO |
CVE-2019-9723HIGH LogicalDOC Community Edition 8.x before 8.2.1 has a path traversal vulnerability that allows reading arbitrary files and the creation of directories, in the class PluginRegistry. | May 30, 2019 | 7.1 | 24 | NO | NO |
CVE-2017-1000022HIGH LogicalDoc Community Edition 7.5.3 and prior contain an Incorrect access control which could leave to privilege escalation. | Jul 17, 2017 | 8.8 | 24 | NO | NO |
CVE-2017-1000021HIGH LogicalDoc Community Edition 7.5.3 and prior is vulnerable to XXE when indexing XML documents. | Jul 17, 2017 | 8.8 | 24 | NO | NO |
CVE-2024-54448HIGH The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges o | Mar 14, 2025 | 7.2 | 21 | NO | NO |
CVE-2025-12546MEDIUM A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1. This affects an unknown part of the component API Key creation UI. This manipulation causes cross site s | Oct 31, 2025 | 5.4 | 20 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Logicaldoc.
Media articles that mention a CVE ID that affects a product developed by Logicaldoc — matched by CVE ID, not by vendor name.