PatchTheCVECVE-2024-54448: The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the u
CVE-2024-54448 is a high-severity flaw (CVSS 7.2) affecting logicaldoc. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation Scripting is needed to carry out the attack. Exploitation of this vulnerability would allow an attacker to run commands of their choosing on the underlying operating system of the web server running LogicalDOC.
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 52%) |
| CISA exploited list | No |
| Weakness | CWE-94 |
| Published | 2025-03-14 |
| Last modified | 2026-08-26 |
Last updated 2026-08-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-54448?
logicaldoc: upgrade to 9.1. Exact commands for each OS are on this page.
Is CVE-2024-54448 being exploited?
CVE-2024-54448 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-54448 affect?
CVE-2024-54448 affects logicaldoc. Severity is high (CVSS 7.2). The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the underlying operating system. An account with administrator privileges or that has been explicitly granted access to use Automation
How urgent is CVE-2024-54448?
Priority 37/100. High severity
Related CVEs
- CVE-2025-11946 LOW 3.5 UPGRADE A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1
- CVE-2025-12547 LOW 3.7 UPGRADE A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1
- CVE-2025-12546 LOW 3.5 UPGRADE A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1
- CVE-2024-54449 HIGH 8.8 UPGRADE The API used to interact with documents in the application contains two endpoints with a flaw that allows an a
- CVE-2024-12020 MEDIUM 6.1 DOWNGRADE There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance