Description

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.

INFO

Published Date :

2026-04-17T20:25:49.843Z

Last Modified :

2026-04-18T03:06:20.406Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-23500 vulnerability.

Vendors Products
Dolibarr
  • Dolibarr
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-23500.

URL Resource
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0 cve-icon cve-icon
https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-w5j3-8fcr-h87w cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability