Medium severity · published Oct 19, 2026
CVE-2026-112361
Dolibarr CSP document.php protection mechanism
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dolibarr · Dolibarr
23.0.0; 23.0.1; 23.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-112361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-112361
github.com
https://github.com/Dolibarr/dolibarr/
github.com
https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec
github.com
https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0
vuldb.com
https://vuldb.com/cve/CVE-2026-112361
vuldb.com
https://vuldb.com/submit/990315
vuldb.com
https://vuldb.com/vuln/422397
More from Dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter