CVE-2026-112361 in Dolibarr
Summary
by MITRE • 10/20/2026
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Dolibarr versions up to 23.0.2 represents a critical failure in Content Security Policy enforcement mechanisms within the web application framework. The flaw resides specifically within an unknown function located in the htdocs/document.php file, which is responsible for handling document-related operations and serving content to end users. This component plays a pivotal role in managing how resources are loaded and rendered by client-side browsers, making its integrity essential for maintaining overall application security posture.
The core technical issue involves a bypass or failure of the Content Security Policy protection mechanism. In modern web applications, CSP serves as an additional layer of defense against cross-site scripting attacks and other code injection vulnerabilities by restricting which sources are allowed to execute scripts, load images, or establish connections. When this mechanism fails due to improper implementation in the document.php handler, it allows malicious actors to inject unauthorized content or execute arbitrary JavaScript within the context of the application. This effectively neutralizes a primary defense layer that would otherwise mitigate the impact of potential injection flaws elsewhere in the system.
From an operational perspective, this vulnerability enables remote code execution scenarios through script injection. An attacker can exploit this flaw without requiring authentication if the affected endpoint is publicly accessible or by leveraging valid user sessions to target specific document views. The ability to bypass CSP significantly increases the risk of data exfiltration, session hijacking, and defacement attacks. Since the attack vector is remote, it poses a severe threat to organizations relying on Dolibarr for enterprise resource planning and customer relationship management, potentially leading to significant confidentiality and integrity compromises.
This issue aligns with CWE-942, which describes improper control of modification of protected memory or configuration settings, specifically relating to security features like CSP being bypassed due to implementation errors. Furthermore, it maps to the MITRE ATT&CK technique T1059 Command and Scripting Interpreter under the Execution tactic, as successful exploitation allows attackers to run scripts within the victim's browser environment. The lack of strict enforcement in document handling functions creates an avenue for persistent threats that can be difficult to detect without comprehensive logging and monitoring solutions.
To resolve this vulnerability, immediate action is required by upgrading Dolibarr to version 24.0.0 or later. This update includes specific patches designed to correct the CSP implementation flaws within the document processing components. Administrators should verify their current installation version and apply the upgrade promptly to restore effective protection mechanisms. Additionally, it is recommended to review server logs for any signs of exploitation attempts prior to patching and to ensure that other security headers are correctly configured as a defense-in-depth strategy against similar future threats.