CVE-2026-23500: Dolibarr ERP/CRM RCE Vulnerability

CVE-2026-23500 Overview

CVE-2026-23500 is a critical command injection vulnerability affecting Dolibarr, an open-source enterprise resource planning (ERP) and customer relationship management (CRM) software package. The vulnerability exists in the ODT to PDF conversion process within odf.php, where the MAIN_ODT_AS_PDF configuration constant is concatenated directly into a shell command passed to exec() without proper sanitization. An authenticated administrator can exploit this flaw by injecting arbitrary OS commands via command separators, achieving remote code execution as the web server user when any ODT template is generated.

Critical Impact

Authenticated administrators can achieve full remote code execution on the underlying server, potentially compromising the entire Dolibarr installation and any connected systems or databases.

Affected Products

• Dolibarr ERP/CRM versions prior to 23.0.0
• Dolibarr installations using ODT to PDF conversion functionality
• Systems with the MAIN_ODT_AS_PDF configuration option enabled

Discovery Timeline

• April 17, 2026 - CVE-2026-23500 published to NVD
• April 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23500

Vulnerability Analysis

This vulnerability represents a classic OS command injection flaw (CWE-78) that arises from the improper neutralization of special elements used in an OS command. The odf.php file in Dolibarr handles the conversion of ODT (OpenDocument Text) templates to PDF format. During this process, the application constructs a shell command by directly concatenating the MAIN_ODT_AS_PDF configuration constant without applying any input validation or sanitization.

The attack requires administrative privileges, meaning the attacker must first obtain authenticated access to the Dolibarr administration interface. Once authenticated, the attacker can modify the MAIN_ODT_AS_PDF configuration value to include command separators (such as ;, |, &&, or backticks) followed by arbitrary system commands. When any user subsequently triggers an ODT to PDF conversion, the malicious payload executes in the context of the web server user.

Root Cause

The root cause of this vulnerability is insufficient input validation and the use of unsanitized user-controllable data in shell command construction. The MAIN_ODT_AS_PDF configuration constant, which can be modified by administrators through the Dolibarr interface, is passed directly to the PHP exec() function without escaping special shell characters or validating the input against an allowlist of acceptable values.

Proper remediation requires sanitizing the configuration value using functions like escapeshellarg() or escapeshellcmd(), or ideally, restructuring the code to avoid shell command execution entirely by using native PHP libraries for PDF conversion.

Attack Vector

The attack vector is network-based and requires prior authentication with administrative privileges. The attacker exploits the vulnerability by:

1. Authenticating to the Dolibarr administrative interface
2. Navigating to the configuration settings where MAIN_ODT_AS_PDF can be modified
3. Injecting a malicious payload containing command separators and arbitrary commands
4. Triggering an ODT template generation to execute the injected commands

The malicious payload executes with the privileges of the web server process (typically www-data, apache, or nginx), potentially allowing the attacker to read sensitive files, modify application data, establish persistence, or pivot to other systems on the network.

Detection Methods for CVE-2026-23500

Indicators of Compromise

• Unusual modifications to the MAIN_ODT_AS_PDF configuration value containing shell metacharacters (;, |, &&, ||, backticks)
• Unexpected process spawning from the web server process during ODT to PDF conversion operations
• Anomalous network connections originating from the web server user account
• Presence of unauthorized files in web-accessible directories or temporary folders

Detection Strategies

• Monitor audit logs for changes to the MAIN_ODT_AS_PDF configuration setting, especially values containing special characters
• Implement web application firewall (WAF) rules to detect command injection patterns in configuration submissions
• Deploy endpoint detection and response (EDR) solutions to identify suspicious child processes spawned by the PHP interpreter
• Review web server access logs for unusual patterns related to ODT template generation endpoints

Monitoring Recommendations

• Enable detailed logging for Dolibarr configuration changes and maintain audit trails for administrative actions
• Configure SentinelOne Singularity Platform to monitor for behavioral indicators of command injection exploitation
• Set up alerts for process execution chains where web server processes spawn unexpected shell commands
• Regularly review the MAIN_ODT_AS_PDF configuration value as part of security configuration audits

How to Mitigate CVE-2026-23500

Immediate Actions Required

• Upgrade Dolibarr to version 23.0.0 or later immediately, as this version contains the official fix for the vulnerability
• Review the current MAIN_ODT_AS_PDF configuration value for any signs of tampering or malicious content
• Audit administrative user accounts and remove unnecessary administrator privileges following the principle of least privilege
• If upgrading is not immediately possible, consider temporarily disabling the ODT to PDF conversion functionality

Patch Information

The vulnerability has been addressed in Dolibarr version 23.0.0. The fix properly sanitizes the configuration input before it is used in shell command construction. Organizations should prioritize upgrading to this version or later. For detailed information about the fix and release notes, refer to the GitHub Release Note 23.0.0. Additional security details are available in the GitHub Security Advisory GHSA-w5j3-8fcr-h87w.

Workarounds

• Disable the ODT to PDF conversion feature by removing or clearing the MAIN_ODT_AS_PDF configuration value until patching is complete
• Implement network segmentation to restrict access to the Dolibarr administrative interface from trusted networks only
• Deploy a web application firewall (WAF) with rules to block command injection patterns targeting the affected endpoint
• Restrict administrative access to a minimal set of trusted users and enforce multi-factor authentication (MFA) for all admin accounts

# Configuration example - Verify MAIN_ODT_AS_PDF setting
# Check the Dolibarr configuration for suspicious values
grep -r "MAIN_ODT_AS_PDF" /var/www/dolibarr/conf/

# If upgrading is not immediately possible, consider disabling the feature
# by clearing the configuration value in the Dolibarr admin panel
# Setup -> Setup -> ODT Templates -> PDF Generation Command: (leave empty)