Dolibarr vulnerabilities
We track 30 vulnerabilities in Dolibarr products across 4 products. 30 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
Latest Dolibarr vulnerabilities
- 7.1 High severity
dolibarr: Authorization Bypass Through User-Controlled Key
Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerability in api_expensereports.class.php payment endpoints that lets authenticated users access other users' expense report payments. Attackers with only ex
- 8.8 High severity
dolibarr: Improper Neutralization of Special Elements used in an SQL Command
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the local
- 7.2 High severity
dolibarr: Improper Neutralization of Special Elements used in an OS Command
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & cha
- 7.6 High severity
dolibarr: Improper Neutralization of Special Elements used in an SQL Command
Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the
- 7.5 High severity
Dolibarr: Incorrect Authorization
Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with ha
- 8.2 High severity
dolibarr: Improper Limitation of a Pathname to a Restricted Directory
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path
- 8.1 High severity
dolibarr: Improper Neutralization of Special Elements used in an SQL Command
Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves
- 8.1 High severity
dolibarr: Incorrect Authorization
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoice-deletion rights to permanently delete any payment record by bypassing the intended payment-issuanc
- 7.1 High severity
dolibarr: Authorization Bypass Through User-Controlled Key
Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by b
- 8.1 High severity
dolibarr: Missing Authorization
Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without verifying password-cha
- 7.6 High severity
dolibarr: Improper Neutralization of Special Elements used in an SQL Command
Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and m
- 7.2 High severity
dolibarr: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled inpu
- 8.8 High severity
Dolibarr Erp/crm: Improper Neutralization of Special Elements used in an OS Command
In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filt
- 8.8 High severity
Dolibarr Erp/crm: Improper Control of Generation of Code
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through un
- 9.1 Critical severity
dolibarr: Improper Neutralization of Special Elements used in an OS Command
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a sh
- 7.2 High severity
Dolibarr ERP/CRM: Improper Control of Generation of Code
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers
- 8.8 High severity
Dolibarr Erp/crm: Improper Control of Generation of Code
Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.
- 9.0 Critical severity
Dolibarr Erp/crm: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
- 9.0 Critical severity
Dolibarr Erp/crm: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter.
- 8.8 High severity
dolibarr_erp\/crm: Improper Control of Generation of Code
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
- 9.1 Critical severity
ERP CMS: Improper Neutralization of Special Elements used in an SQL Command
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the
- 9.1 Critical severity
ERP CMS: Improper Neutralization of Special Elements used in an SQL Command
Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the
- 7.5 High severity
dolibarr_erp\/crm: Cross-Site Request Forgery
Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover.
- 8.8 High severity
Dolibarr Erp/crm: Improper Control of Generation of Code
Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input.
- 8.8 High severity
Dolibarr ERP CRM: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
- 9.6 Critical severity
Dolibarr Erp/crm: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
- 8.8 High severity
Dolibarr Erp/crm: Unrestricted Upload of File with Dangerous Type
File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
- 7.5 High severity
Dolibarr Erp/crm: Files or Directories Accessible to External Parties
An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.
- 9.8 Critical severity
dolibarr/dolibarr: Improper Neutralization of Special Elements used in an SQL Command
SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputatio
- 9.8 Critical severity
Dolibarr Erp/crm: Improper Control of Generation of Code
Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.