OS Command Injection in dolibarr - CVE-2026-23500
Published: April 20, 2026
Vulnerability identifier: #VU126579
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-23500
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary operating system commands.
The vulnerability exists due to command injection in htdocs/includes/odtphp/odf.php when converting ODT documents to PDF using the MAIN_ODT_AS_PDF configuration constant. A remote privileged user can inject a malicious command path into the configuration value to execute arbitrary operating system commands.
Exploitation requires the Commercial Proposals module and ODT templates to be enabled.
Affected software
dolibarr
How to mitigate CVE-2026-23500
Install security update from vendor's website.
dolibarr - update to 23.0.0