CVE-2026-23500 CRITICAL

CVE-2026-23500: Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

Vendor Dolibarr
Product dolibarr
Weakness CWE-78
Published April 17, 2026
Last update April 18, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.

Key dates

02Disclosure timeline

April 17, 2026 CVE published
April 18, 2026 Record updated