Path Traversal in Logicaldoc Community
CVE-2024-12019
The API used to interact with documents in the application contains a flaw that allows an authenticated attacker to read the contents of files on the underlying operating system. An account with ‘read’ and ‘download’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would allow an attacker to read the contents of any file available within the privileges of the system user running the application.
EPSS: 0.004 (35.4th percentile) — read the EPSS interpretation.
Affected products
- Logicaldoc Community — versions 0
- Logicaldoc Enterprise — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@synopsys.com (third-party-advisory)
Frequently asked questions
- What is CVE-2024-12019?
- CVE-2024-12019 is a vulnerability in Logicaldoc Community, classified under Relative Path Traversal. Published 2025-03-14.
- Is CVE-2024-12019 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.