LogicalDOC Community Edition up to version 9.3 allows an authenticated user to run arbitrary operating system commands by embedding Velocity templates in the subject or message of the sendAsEmail function. The application permits use of SystemTool.exec and ClassTool classes despite a built-in denylist, providing a direct path to execute code with the process’s privileges. This is a CWE‑94 Code Injection vulnerability. Successful exploitation grants full control of the server and data.

Vulnerable installations are those running LogicalDOC Community Edition revisions through 9.3. Any instance that has not applied upgrades beyond this major release remains susceptible, irrespective of deployment specifics.

The CVSS base score of 8.7 indicates high severity remote code execution. No EPSS data is published, and the entry is not listed in the CISA KEV catalog, suggesting limited known exploitation. Attackers must first authenticate, then craft a malicious Velocity template to trigger the hidden exec path. Executed commands run under the LogicalDOC process identity, providing extensive system compromise.