GHSA-676v-wh57-p375

Dolibarr Allows Code Injection through its Website Module

Source: GitHub Advisory Database (reviewed) High CVE-2026-31018

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	dolibarr/dolibarr	<= 15.0.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation. A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-31018 advisory
https://github.com/Dolibarr/dolibarr/commit/ba28d16da4cc0c221f49a878fecc8425501ceb96 web
https://github.com/Dolibarr/dolibarr package
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0 web
https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md web
http://dolibarr.com web