CVE-2026-31018: Dolibarr ERP/CRM RCE Vulnerability

CVE-2026-31018 Overview

CVE-2026-31018 is a code injection vulnerability in Dolibarr ERP & CRM versions 22.0.4 and earlier. The vulnerability exists in the Website module where PHP code detection and editing permission enforcement is not applied consistently to all input parameters. This inconsistent security control allows an authenticated user who is restricted to HTML/JavaScript editing to bypass these restrictions and inject PHP code through unprotected inputs during website page creation.

Critical Impact

Authenticated attackers with limited editing privileges can inject and execute arbitrary PHP code on the server, potentially leading to complete system compromise, data exfiltration, and unauthorized access to sensitive business information stored in the ERP/CRM system.

Affected Products

• Dolibarr ERP/CRM versions up to and including 22.0.4
• Dolibarr Website module with page creation functionality enabled
• Systems allowing authenticated users with HTML/JavaScript editing permissions

Discovery Timeline

• 2026-04-21 - CVE CVE-2026-31018 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31018

Vulnerability Analysis

This vulnerability (CWE-94: Improper Control of Generation of Code) stems from inconsistent input validation in Dolibarr's Website module. While the application implements PHP code detection and permission enforcement for certain input fields, not all input parameters receive the same level of scrutiny. An attacker with legitimate access to the website page creation functionality can exploit these unprotected input vectors to inject arbitrary PHP code.

The attack requires network access and low-privilege authentication, but no user interaction is necessary for exploitation. Successful exploitation can result in complete compromise of the confidentiality, integrity, and availability of the affected system and any data it processes.

Root Cause

The root cause of CVE-2026-31018 is the inconsistent application of security controls across input parameters in the Website module. The development team implemented PHP code detection and permission checks for some inputs but failed to apply these same controls universally. This created a security gap where certain input fields bypass the intended restrictions, allowing users with limited permissions (HTML/JavaScript only) to inject executable PHP code.

Attack Vector

The attack is executed over the network by an authenticated user who has been granted restricted editing permissions (specifically, permissions limited to HTML/JavaScript editing only). The attacker exploits the inconsistent input validation by:

1. Authenticating to the Dolibarr application with valid credentials
2. Navigating to the Website module's page creation functionality
3. Identifying input parameters that lack PHP code detection controls
4. Injecting malicious PHP code through the unprotected input fields
5. Triggering execution of the injected code when the created page is processed

The vulnerability does not require user interaction beyond the attacker's own actions, and the exploitation complexity is low. Technical details and a proof-of-concept are available in the GitHub PoC for CVE-2026-31018.

Detection Methods for CVE-2026-31018

Indicators of Compromise

• Unexpected PHP code present in website page content or templates created by users with HTML/JavaScript-only permissions
• Web server logs showing POST requests to website page creation endpoints with PHP code snippets in parameters
• Newly created or modified files in the Dolibarr document root containing PHP execution functions such as exec(), system(), passthru(), or eval()
• Anomalous outbound network connections originating from the web server process

Detection Strategies

• Monitor audit logs for website page creation events by users who should only have HTML/JavaScript editing permissions
• Implement web application firewall (WAF) rules to detect PHP code patterns in HTTP POST parameters targeting Dolibarr endpoints
• Deploy file integrity monitoring on Dolibarr's web directories to detect unauthorized PHP file modifications
• Configure SentinelOne agents to detect and alert on suspicious PHP process behavior indicative of code injection attacks

Monitoring Recommendations

• Enable verbose logging for the Dolibarr Website module and review logs regularly for suspicious activity
• Implement real-time alerting for any PHP code patterns detected in user-submitted content
• Monitor server-side script execution patterns for anomalies that may indicate injected code execution

How to Mitigate CVE-2026-31018

Immediate Actions Required

• Upgrade Dolibarr ERP & CRM to a patched version beyond 22.0.4 when available from the vendor
• Review and restrict user permissions for the Website module, removing page creation access from untrusted users
• Audit existing website pages for any injected PHP code and remove malicious content
• Implement additional input validation at the web application firewall level to block PHP code in form submissions

Patch Information

Organizations running Dolibarr ERP & CRM version 22.0.4 or earlier should monitor the Dolibarr Official Site for security updates addressing this vulnerability. When a patch becomes available, apply it immediately following your organization's change management procedures. The GitHub PoC repository may contain additional technical details about the vulnerability.

Workarounds

• Disable or restrict access to the Website module's page creation functionality until a patch is available
• Remove or limit user accounts that have HTML/JavaScript editing permissions to only trusted administrators
• Deploy a web application firewall with rules configured to block PHP code injection patterns
• Implement network segmentation to limit the impact of potential compromise

# Restrict Website module access in Dolibarr configuration
# Edit the htdocs/conf/conf.php file to limit module permissions
# Disable website module temporarily if not business-critical
# Example: Navigate to Setup > Modules and disable Website module
# Or restrict user permissions via Setup > Users & Groups > Permissions