Dolibarr Allows Code Injection through its Website Module

HIGH 8.8CVE-2026-31018 · GHSA-676v-wh57-p375 · Published 21/04/2026 · updated 05/07/2026

In short

CVE-2026-31018 is a HIGH (CVSS 8.8) vulnerability affecting dolibarr/dolibarr, dolibarr erp/crm (dolibarr).
Chance of exploitation in the next 30 days (EPSS): 0.27%, higher than 19.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
dolibarr/dolibarr Packagist	`≤ 15.0.3`	No fix yet
dolibarr erp/crm dolibarr	`≤ 22.0.4`	No fix yet

Description

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2026-31018 · ADVISORY
Dolibarr/dolibarr commit ba28d16 · WEB
Dolibarr/dolibarr · PACKAGE
Dolibarr/dolibarr release 23.0.0 · WEB
PhDg1410/CVE · WEB
dolibarr.com · WEB

More vulnerabilities in dolibarr/dolibarr

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

dolibarr/dolibarr

Packagist

≤ 15.0.3

No fix yet

dolibarr erp/crm

dolibarr

≤ 22.0.4

No fix yet

Description

A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

NVD description

More vulnerabilities in dolibarr/dolibarr

See all →