LogicalDOC Community Edition up to version 9.3 contains a parameter-based SQL injection that allows an authenticated attacker with low privileges to inject custom UNION SELECT statements via the firstLetter parameter of the TagsDataServlet. The vulnerability enables the retrieval of sensitive data such as usernames, email addresses, and password hashes from the ld_user table, representing a significant data disclosure risk. This flaw is a classic example of CWE‑89, where unvalidated input directly influences SQL query construction.

The affected product is LogicalDOC Community Edition. Any deployment of this edition running version 9.3 or earlier is susceptible. No specific sub‑versions are listed beyond the general 9.3 release envelope.

With a CVSS score of 7.1 the issue is moderately high severity. The EPSS score is currently not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited known exploitation at present. The attack requires authenticated access; however, low‑privileged users can leverage the injection to read confidential data, making the threat vector effectively an authenticated data extraction exploit.