CVE-2026-109170

LogicalDOC Community Edition versions through 9.3 are vulnerable to an HQL injection vulnerability within the DocumentsDataServlet component. The root cause is an unvalidated indexed parameter that allows authenticated users with read access to any folder to inject boolean HQL expressions. This f...