CVE-2026-109205
Received Received - Intake

Unauthenticated File Upload in LogicalDOC Community Edition

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109205
EUVD
EUVD-2026-97440

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
LogicalDOC LogicalDOC Community Edition 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LogicalDOC Community Edition through 9.3 has an unauthenticated file upload flaw in the UploadServlet. Attackers can exploit this by sending multipart requests to /upload without a session, writing files to disk and filling temporary directories with junk data, causing disk exhaustion.

Detection Guidance

Check for unusual file upload activity in web server logs, particularly to /upload endpoints. Monitor disk space usage for unexplained consumption in temporary directories. Look for repeated multipart requests with excessive file parts.

Impact Analysis

This vulnerability allows remote attackers to consume all available disk space on the server by repeatedly uploading files. This can lead to service outages, degraded performance, or complete system failure due to lack of storage.

Compliance Impact

This vulnerability could lead to unauthorized file uploads and disk exhaustion, potentially violating data integrity and availability requirements in GDPR and HIPAA. Uncontrolled file storage may expose sensitive data or prevent access to critical records, which are key compliance concerns under these regulations.

Mitigation Strategies

Restrict access to the /upload endpoint, implement rate limiting, and enforce authentication for file uploads. Regularly clean temporary directories and monitor disk space. Consider upgrading to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart