Dolibarr vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116219 Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass theHigh 8.6 · Oct 26, 2026
• CVE-2026-116218 Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-High 7.2 · Oct 26, 2026
• CVE-2026-110874 Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restriHigh 7.5 · Oct 15, 2026
• CVE-2026-89013 Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document High 8.7 · Sep 11, 2026
• CVE-2026-89012 Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers High 7.1 · Sep 11, 2026
• CVE-2026-81730 Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename.High 8.8 · Aug 27, 2026
• CVE-2026-81729 Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission.High 7.1 · Aug 27, 2026
• CVE-2026-81728 Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard.High 8.6 · Aug 27, 2026
• CVE-2026-71511 Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to rHigh 7.1 · Aug 24, 2026
• CVE-2026-71510 Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitiHigh 7.1 · Aug 24, 2026
• CVE-2026-71509 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with High 7.1 · Aug 24, 2026
• CVE-2026-71508 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modHigh 7.1 · Aug 24, 2026
• CVE-2026-71507 Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated atHigh 7.1 · Aug 24, 2026
• CVE-2026-71506 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the payments REST API delete endpoint that allows authenticated attackers with invoicHigh 7.2 · Aug 24, 2026
• CVE-2026-71505 Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticateHigh 7.1 · Aug 24, 2026
• CVE-2026-71504 Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset High 8.6 · Aug 24, 2026
• CVE-2026-58376 Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database coHigh 7.2 · Jun 30, 2026
• CVE-2018-25357 Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code throCritical 9.3 · May 23, 2026
• CVE-2025-67486 Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.High 8.6 · May 8, 2026
• CVE-2026-31019 In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to systHigh 8.8 · Apr 21, 2026
• CVE-2026-31018 In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parametersHigh 8.8 · Apr 21, 2026
• CVE-2026-23500 Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.Critical 9.4 · Apr 17, 2026
• CVE-2019-25710 Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary High 8.8 · Apr 12, 2026
• CVE-2026-22666 Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply fHigh 8.6 · Apr 7, 2026
• CVE-2019-25452 Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers tHigh 8.8 · Feb 22, 2026