CVE-2019-25257

LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation

CVSS 8.7 HIGHEPSS 0.4%CWE-426

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.7EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Dec 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

LogicalDOC Srl · LogicalDOC Enterprise

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.exploit-db.com/exploits/44021 https://www.logicaldoc.com https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5452.php