LogicalDOC Remote Code Execution Vulnerability via Arbitrary File Write in Document API

A remote code execution vulnerability has been identified in LogicalDOC's document management system, affecting both the community and enterprise editions. The issue arises in the API endpoints used to interact with documents, where an authenticated attacker can exploit a flaw that allows writing files with controlled contents to arbitrary locations on the underlying file system. This vulnerability requires an account with read and write privileges on at least one existing document. The exploitation of this flaw could lead to the execution of arbitrary commands on the operating system of the web server running LogicalDOC.

Impact

Exploitation of this vulnerability would allow an authenticated attacker to execute commands of their choosing on the operating system of the web server hosting LogicalDOC.

Remediation

This vulnerability has been addressed in LogicalDOC Community and Enterprise Editions version 9.1.