CVE-2026-23500
Received Received - Intake
Command Injection in Dolibarr ODT to PDF Conversion Allows RCE

Publication date: 2026-04-17

Last updated on: 2026-05-01

Assigner: GitHub, Inc.

Description
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-17
Last Modified
2026-05-01
Generated
2026-06-16
AI Q&A
2026-04-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23500
EUVD
EUVD-2026-23502
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
dolibarr dolibarr_erp/crm to 23.0.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in Dolibarr versions prior to 23.0.0 in the ODT to PDF conversion process handled by the odf.php file. The issue arises because the MAIN_ODT_AS_PDF configuration constant is concatenated directly into a shell command passed to the exec() function without any sanitization. An authenticated administrator can exploit this by injecting arbitrary operating system commands using command separators. This leads to remote code execution with the privileges of the web server user whenever any ODT template is generated.

Impact Analysis

The vulnerability allows an authenticated administrator to execute arbitrary operating system commands on the server running Dolibarr. This can lead to remote code execution, potentially compromising the entire server environment. Attackers could manipulate or steal sensitive data, disrupt services, or use the server as a foothold for further attacks.

Mitigation Strategies

To mitigate this vulnerability, upgrade Dolibarr to version 23.0.0 or later, where the issue has been fixed.

Ensure that only trusted administrators have access to the system, as exploitation requires authenticated administrator privileges.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23500. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart