Path Traversal in Logicaldoc Community
CVE-2024-12019
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (37.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Logicaldoc Community — versions 0
- Logicaldoc Enterprise — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.blackduck.com/blog/cyrc-advisory-logicaldoc.html (third-party-advisory)
Frequently asked questions
- What is CVE-2024-12019?
- CVE-2024-12019 is a vulnerability in Logicaldoc Community, classified under Relative Path Traversal. Published 2025-03-14.
- Is CVE-2024-12019 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.