CVE-2026-109170Published
LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109170 · Microsoft / collected KEV context
cve-program · CVE-2026-109170
- https://github.com/logicaldoc/community/discussions/119
- https://github.com/logicaldoc/community/commit/c3bbfd4641f1cd2b340f114ea198d3f65b6581ee
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-webapp/src/main/java/com/logicaldoc/web/data/DocumentsDataServlet.java#L443
- https://github.com/logicaldoc/community
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-hql-injection-via-documents-xml-indexed-parameter
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.