Is CVE-2026-109169 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109169?

CVE-2026-109169 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109169

Description

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via the firstLetter parameter of TagsDataServlet. Low-privileged attackers can inject UNION SELECT statements returned in the XML tag list to read usernames, email addresses and password hashes from ld_user.