> CVE-2026-31018

« BACK_TO_HOME
PUBLISHED
2026-04-21 15:16
MODIFIED
2026-04-21 15:16
EPSS (Prob. Exploit)
0.27%
Top 80.2%
DATA SOURCES:
NVD 🔗 2026-04-21 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-05 OSV 🔗 2026-11-02

> DESCRIPTION

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-676v-wh57-p375 HIGH

Dolibarr Allows Code Injection through its Website Module

AFFECTED PACKAGES:
COMPOSER / dolibarr/dolibarr
<= 15.0.3

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:
Unknown / Unknown
24 versions affected
ALIASES:
GHSA-676v-wh57-p375

> HISTORIQUE DES MODIFICATIONS

Première apparition
21/04/2026 15:16
Source: NVD
Total des modifications: 0 Dernière mise à jour: 6 months ago

> REFERENCES

http://dolibarr.com
https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md
« BACK_TO_HOME