CVE-2026-112361

Deferred Deferred - Pending Action

CSP Bypass in Dolibarr via document.php

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-112361

Affected Vendors & Products

Vendor	Product	Version / Range
n/a	Dolibarr	23.0.0
n/a	Dolibarr	23.0.1
n/a	Dolibarr	23.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability affects Dolibarr versions up to 23.0.2. It involves a failure in the Content Security Policy (CSP) mechanism due to an unknown function in the document.php file. The issue allows remote attackers to bypass security protections. Upgrading to Dolibarr 24.0.0 fixes the problem.

Detection Guidance

To detect this vulnerability, check the installed version of Dolibarr. If it is below 24.0.0, the system is vulnerable. Use commands like 'dpkg -l | grep dolibarr' on Debian-based systems or 'rpm -qa | grep dolibarr' on RPM-based systems to verify the version.

Impact Analysis

The vulnerability could allow remote attackers to bypass security controls, potentially leading to unauthorized access or data manipulation. Attackers might exploit it to inject malicious content or steal sensitive information if the CSP is compromised.

Mitigation Strategies

Upgrade Dolibarr to version 24.0.0 or later immediately. The patch is available as commit 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. Follow standard upgrade procedures for your installation method.

Hi! I’m here to help you understand CVE-2026-112361. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70