PT-2026-33504 · Dolibarr · Dolibarr

Lukasz-Rybak · Published 2026-04-17 · Updated 2026-05-10 · CVE-2026-23500

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 23.0.0

Description Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. An authenticated administrator can achieve remote code execution as the web server user by injecting arbitrary OS commands into the MAIN ODT AS PDF configuration constant. This occurs during the ODT to PDF conversion process in 'odf.php', where the constant is concatenated directly into a shell command passed to the exec() function without proper sanitization. Approximately 56.8K services are estimated to be affected worldwide.

Recommendations Update to version 23.0.0. As a temporary workaround, restrict administrative access to the configuration settings for the MAIN ODT AS PDF constant to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-23500

GHSA-W5J3-8FCR-H87W

Affected Products

Dolibarr

References · 14

• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-w5j3-8fcr-h87w · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w5j3-8fcr-h87w · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23500 · Security Note
• https://ubuntu.com/security/CVE-2026-23500 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23500 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23500 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0 · Note
• https://twitter.com/HunterMapping/status/2046417092396683520 · Twitter Post
• https://t.me/cveNotify/161793 · Telegram Post
• https://twitter.com/0dayPublishing/status/2045244597874327625 · Twitter Post
• https://twitter.com/dailycve/status/2045260430348530127 · Twitter Post
• https://twitter.com/CVEnew/status/2045467403325264087 · Twitter Post
• https://twitter.com/lyrie_ai/status/2053394131695632679 · Twitter Post