Dolibarr up to 23.x Import Wizard import.php import_insert updatekeys sql injection

Summaryinfo

A vulnerability labeled as critical has been found in Dolibarr up to 23.x. The impacted element is the function import_insert of the file htdocs/imports/import.php of the component Import Wizard. Such manipulation of the argument updatekeys leads to sql injection. This vulnerability is uniquely identified as CVE-2026-81728. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Dolibarr up to 23.x and classified as critical. Affected by this issue is the function import_insert of the file htdocs/imports/import.php of the component Import Wizard. The manipulation of the argument updatekeys with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers, parentheses, spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv.modules.php then iterates the submitted values and builds a filter with $where[] = $key.' = '.$data[$key], having first applied preg_replace('/^.*\./i', '', $key), an alias strip that does nothing to a value containing no dot. The assembled string is executed through $this->db->query(). The injected SELECT resolves the row id that the import then assigns to $lastinsertid, which becomes the WHERE target of a subsequent UPDATE, so a UNION SELECT returning an attacker-chosen integer both exfiltrates arbitrary table content and redirects which row the import overwrites; for category link tables the raw filter array is spliced into that UPDATE directly. The interface offers a fixed list of legitimate column codes but the server never checks the submitted values against it. A user holding the import permission can exploit this. Release 23.0.4 does not carry the fix; the allow-list test was added in 24.0.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-81728 since 08/27/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

By approaching the search of inurl:htdocs/imports/import.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 24.0.0 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Enterprise Resource Planning Software

Name

• Dolibarr

Version

• 23.x

License

• open-source

Website

• Product: https://github.com/Dolibarr/dolibarr/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion