CVE-2019-25257CWE-426

LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation

High · published December 24, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2025-12-24T19:28Z
EPSS history
Timeline
  • 24 DEC 19:28Z
    LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation
    cvelistv5