CVE-2026-31018

HIGH

Dolibarr ERP & CRM <=22.0.4 - Code Injection

Title source: llm

Description

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

References (2)

http://dolibarr.com

https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md

View Writeup ZIP pw:eip

Scores

CVSS v3 8.8

EPSS 0.0004

EPSS Percentile 11.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-284 CWE-94

Status published

Products (1)

dolibarr/dolibarr_erp\/crm < 22.0.4

Published Apr 21, 2026

Tracked Since Apr 21, 2026