Critical severity · published Apr 17, 2026
CVE-2026-23500
Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
9.1
CVSS
0.9%
EPSS
No
On KEV
Description
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
dolibarr · Dolibarr
< 23.0.0 · source: vendor
DE
Dolibarr Erp/crm · Dolibarr
before 23.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23500
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23500
Product
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0
Exploit
https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-w5j3-8fcr-h87w
More from dolibarr
9.8
CVE-2019-19212
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen)
9.8
CVE-2018-16809
An issue was discovered in Dolibarr through 7.0.0
9.8
CVE-2018-9019
SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to execute arbitrary SQL commands via the sortfield parameter to…
9.8
CVE-2018-10094
SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes
9.8
CVE-2017-14242
SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter