CVE-2026-31018: Dolibarr Allows Code Injection through its Website Module

April 21, 2026 (updated April 25, 2026)

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

References

github.com/Dolibarr/dolibarr/commit/ba28d16da4cc0c221f49a878fecc8425501ceb96
github.com/Dolibarr/dolibarr/releases/tag/23.0.0
github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md
github.com/advisories/GHSA-676v-wh57-p375
nvd.nist.gov/vuln/detail/CVE-2026-31018

Code Behaviors & Features

Detect and mitigate CVE-2026-31018 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →