CVE-2026-23500 - Vulnerability Analysis

Overview

Dolibarr < 23.0.0 contains a command injection caused by unsanitized MAIN_ODT_AS_PDF configuration constant concatenated in shell command in odf.php, letting authenticated administrators execute arbitrary OS commands, exploit requires admin privileges.

Severity & Score

Impact

Authenticated administrators can execute arbitrary OS commands as the web server user, leading to full remote code execution.

Mitigation

Upgrade to version 23.0.0 or later.

References

• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-w5j3-8fcr-h87w

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner