PatchTheCVECVE-2024-54449: The API used to interact with documents in the application contains two endpoints with a flaw that allows an a
CVE-2024-54449 is a high-severity flaw (CVSS 8.8) affecting logicaldoc. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be used to facilitate RCE. An account with ‘read’ and ‘write’ privileges on at least one existing document in the application is required to exploit the vulnerability. Exploitation of this vulnerability would all
Why this priority
- High severity
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 51%) |
| CISA exploited list | No |
| Weakness | CWE-23 |
| Published | 2025-03-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-54449?
logicaldoc: upgrade to 9.1. Exact commands for each OS are on this page.
Is CVE-2024-54449 being exploited?
CVE-2024-54449 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-54449 affect?
CVE-2024-54449 affects logicaldoc. Severity is high (CVSS 8.8). The API used to interact with documents in the application contains two endpoints with a flaw that allows an authenticated attacker to write a file with controlled contents to an arbitrary location on the underlying file system. This can be
How urgent is CVE-2024-54449?
Priority 43/100. High severity
Related CVEs
- CVE-2025-11946 LOW 3.5 UPGRADE A security flaw has been discovered in LogicalDOC Community Edition up to 9.2.1
- CVE-2025-12547 LOW 3.7 UPGRADE A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1
- CVE-2025-12546 LOW 3.5 UPGRADE A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1
- CVE-2024-54448 HIGH 7.2 UPGRADE The Automation Scripting functionality can be exploited by attackers to run arbitrary system commands on the u
- CVE-2024-12020 MEDIUM 6.1 DOWNGRADE There is a reflected cross-site scripting (XSS) within JSP files used to control application appearance