CVE-2024-54448

Remote Code Execution (RCE) via Automation Scripting

State: Published
Severity: 8.6 High
Published: Mar 14, 2025
Updated: Aug 26, 2026
Reserved: Dec 2, 2024

Description

The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	BlackDuck

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
LogicalDOC CommunityLogicalDOC	before 9.1Affected
LogicalDOC EnterpriseLogicalDOC	before 9.1Affected

References

https://www.blackduck.com/blog/cyrc-advisory-logicaldoc.htmlthird-party-advisory
http://seclists.org/fulldisclosure/2026/Aug/85

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.