LogicalDOC Automation Scripting Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Automation Scripting feature of LogicalDOC document management system. This issue allows attackers to execute arbitrary system commands on the operating system hosting the LogicalDOC web server. The vulnerability affects both the Community and Enterprise editions of LogicalDOC, specifically in version 8.9.3. To exploit this vulnerability, an account with administrator privileges or explicit access to Automation Scripting is required.

Impact

Exploitation of this vulnerability would enable an attacker to execute commands of their choice on the operating system of the web server running LogicalDOC.

Remediation

This vulnerability has been addressed in LogicalDOC Community and Enterprise Editions version 9.1.