PT-2026-33981 · Unknown · Dolibarr Erp/Crm

Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-31018

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5

Description In the Website module, PHP code detection and editing permission enforcement is not applied consistently to all input parameters. This allows an authenticated user who is restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during the creation of website pages.

Recommendations Update to a version newer than 22.0.4.

Exploit

Fix

Code Injection

Improper Access Control

Weakness Enumeration

CWE-94

CWE-284

Related Identifiers

CVE-2026-31018

GHSA-676V-WH57-P375

Affected Products

Dolibarr Erp/Crm

References · 11

• 🔥 https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md · Exploit
• https://ubuntu.com/security/CVE-2026-31018 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-676v-wh57-p375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31018 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31018 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31018 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0 · Note
• https://github.com/Dolibarr/dolibarr/commit/ba28d16da4cc0c221f49a878fecc8425501ceb96 · Note
• https://twitter.com/CVEnew/status/2046601501498347874 · Twitter Post
• http://dolibarr.com · Note