CVE-2019-25257 HIGH

CVE-2019-25257: LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation

Vendor Logicaldoc Srl
Product LogicalDOC Enterprise
Weakness CWE-426
Published December 24, 2025
Last update March 5, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.

Key dates

02Disclosure timeline

December 24, 2025 CVE published
March 5, 2026 Record updated