PT-2025-11299 · Unknown · Logicaldoc

Matthew Hogg · Published 2025-03-14 · Updated 2025-11-07 · CVE-2024-54449

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LogicalDOC (affected versions not specified)

Description The application's API, used for document interaction, contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled content to an arbitrary location on the underlying file system. This can be used to facilitate Remote Code Execution (RCE). Exploitation requires an account with ‘read’ and ‘write’ privileges on at least one existing document within the application. Successful exploitation would allow an attacker to execute commands on the underlying operating system of the web server running LogicalDOC. The vulnerable API endpoints allow for arbitrary file writing. The file content is controlled by the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2024-54449

Affected Products

Logicaldoc

References · 8

• https://osv.dev/vulnerability/CVE-2024-54449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54449 · Security Note
• https://t.me/cvetracker/19151 · Telegram Post
• https://blackduck.com/blog/cyrc-advisory-logicaldoc.html · Note
• https://twitter.com/CVEnew/status/1900619155088294212 · Twitter Post
• https://twitter.com/CveFindCom/status/1900616033951432762 · Twitter Post
• https://t.me/cvedetector/20337 · Telegram Post
• https://t.me/cveNotify/142044 · Telegram Post