LogicalDOC Community Edition versions up to and including 9.3 contains an unauthenticated file upload flaw in the UploadServlet. Exploiting the vulnerability, a remote attacker can send multipart requests with unlimited file parts to the /upload endpoint, causing the application to persist each uploaded file in temporary directories that are never cleaned. The unchecked growth of these files consumes server disk space, resulting in resource exhaustion. The vulnerability allows an attacker to perform this activity without authentication or a user session, meaning any network-visible host running the affected application is susceptible. The correct effect is a denial of service through disk usage exhaustion rather than direct control over program execution.

LogicalDOC Community Edition versions through 9.3 are affected. The flaw resides in the UploadServlet component of the Community Edition and applies to all deployments of that edition that have the default /upload servlet exposed.

The CVSS score of 8.7 establishes this flaw as a high severity issue. The EPSS score is not available, which does not indicate whether current exploitation likelihood is high or low; however, the lack of authentication and the ability to issue unlimited file uploads suggest a straightforward attack path. The vulnerability is not listed in the CISA KEV catalog, but due to its high severity and wide availability, it should be treated as a priority risk. Attackers can trigger the resource exhaustion simply by sending repeated requests to the exposed upload endpoint, making it an easy and reliable vector for denial of service.