PT-2026-33981 · Unknown · Dolibarr Erp/Crm

CVE-2026-31018 · Published 2026-04-21 · Updated 2026-04-22

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5

Description In the Website module, PHP code detection and editing permission enforcement is not applied consistently to all input parameters. This allows an authenticated user who is restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during the creation of website pages.

Recommendations Update to a version newer than 22.0.4.

Exploit

Fix

Improper Access Control

Code Injection

Weakness Enumeration

CWE-284

CWE-94

Related Identifiers

CVE-2026-31018

GHSA-676V-WH57-P375

Affected Products

Dolibarr Erp/Crm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31018.json · Exploit
• 🔥 https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md · Exploit
• https://osv.dev/vulnerability/GHSA-676v-wh57-p375 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31018 · Security Note
• https://osv.dev/vulnerability/CVE-2026-31018 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31018 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31018 · Vendor Advisory
• https://github.com/Dolibarr/dolibarr · Note
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0 · Note
• https://github.com/Dolibarr/dolibarr/commit/ba28d16da4cc0c221f49a878fecc8425501ceb96 · Note
• https://twitter.com/CVEnew/status/2046601501498347874 · Twitter Post
• http://dolibarr.com · Note