CVE-2026-71511

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists.

CVE-2017-14242 is an SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 that allows remote attackers to execute arbitrary SQL commands via the statut parameter.

Dolibarr versions 9.0.0 through 23.0.4 save inbound email attachments under the name supplied in MIME headers without reducing it to a safe basename. The saveAttachment() functions in htdocs/emailcollector/lib/emailcollector.lib.php and htdocs/emailcollector/class/emailcollector.class.php build the file path from the attachment name, which may contain path traversal sequences, allowing writes outside the target directory.

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.

Dolibarr before 24.0.0 contains a SQL injection vulnerability in its CSV and XLSX import wizard. The wizard reads update keys via GETPOST('updatekeys', 'array') in htdocs/imports/import.php, applying only the generic alphanohtml filter that leaves SQL keywords, comment markers, parentheses, spaces, and quotes intact. The import_insert() function in htdocs/core/modules/import/import_csv.modules.php builds a filter with $where[] = $key.' = '.$data[$key] and executes it via $this->db->query(), allowing SQL injection.

Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks into unauthorized private projects.

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API. Authenticated attackers with user-read rights can extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search on numeric fields and LIKE prefix iteration on string fields to recover salary figures and password verifiers, while raw database errors enable column name enumeration.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint. Authenticated attackers with expense-creation rights can bypass the approval workflow by directly setting approval status and approver identity fields. Attackers can manipulate workflow state fields to advance expense reports to approved or closed status without possessing the dedicated approval right, while also creating forensic inconsistencies in audit records due to missing approval timestamps.

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint. Attackers with user-write rights can modify payroll fields by exploiting an incomplete credential denylist that omits payroll columns. Attackers can rewrite salary, bonus, hourly rate, daily rate, and weekly hours for any user without holding payroll rights, with the modified values appearing in payroll export reports.

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes. Authenticated attackers with third-party creation rights can create, replace, or delete bank account details of any company without requiring read access to that company. Attackers can inject attacker-controlled IBANs as creditor accounts, which are then written into regenerated SEPA credit-transfer files, redirecting outgoing payments to attacker-controlled accounts.