CVE-2026-31018: Dolibarr Allows Code Injection through its Website Module

April 21, 2026 (updated April 25, 2026)

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

References

github.com/Dolibarr/dolibarr
github.com/Dolibarr/dolibarr/commit/ba28d16da4cc0c221f49a878fecc8425501ceb96
github.com/Dolibarr/dolibarr/releases/tag/23.0.0
github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md
github.com/advisories/GHSA-676v-wh57-p375
nvd.nist.gov/vuln/detail/CVE-2026-31018

Code Behaviors & Features

Detect and mitigate CVE-2026-31018 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →