CVE-2026-71503: Dolibarr Reflected XSS Vulnerability

CVE-2026-71503 Overview

CVE-2026-71503 is a reflected cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM versions before 24.0.0. The flaw resides in the extra fields administration template, where the type request parameter is echoed into an inline JavaScript block without JavaScript-context encoding. The application also fails to emit a Content-Security-Policy header, removing a key mitigating control. An unauthenticated attacker who convinces an authenticated administrator to open a crafted URL can execute arbitrary JavaScript in that administrator's browser session. The classification aligns with CWE-79 — Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation lets an attacker execute JavaScript in an administrator's session and create a persistent administrator account, resulting in full application takeover.

Affected Products

Dolibarr ERP/CRM versions prior to 24.0.0
Vulnerable file: htdocs/core/tpl/admin_extrafields_add.tpl.php
Vulnerable file: htdocs/product/admin/product_extrafields.php

Discovery Timeline

2026-08-24 - CVE-2026-71503 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-71503

Vulnerability Analysis

Dolibarr renders the type HTTP parameter directly into an inline <script> block within the extra fields administration template. The template calls GETPOST('type', 'alpha') and passes the value into init_typeoffields() without applying JavaScript string escaping. An attacker who controls the type value can break out of the JavaScript string literal and inject arbitrary script into the administrator's page context.

The absence of a Content-Security-Policy response header removes an additional defense layer. Once the injected script runs, it inherits the administrator's authenticated session cookies and can invoke any privileged endpoint the admin can reach, including user creation forms.

Root Cause

The root cause is missing JavaScript-context output encoding. The alpha filter used by GETPOST sanitizes for HTML contexts but does not neutralize characters relevant to a JavaScript string literal, such as single quotes and backslashes. Injecting a closing quote and a semicolon terminates the string and lets subsequent characters execute as code.

Attack Vector

Exploitation requires an unauthenticated attacker to deliver a crafted URL to an authenticated Dolibarr administrator, typically via phishing, social engineering, or an embedded link on a controlled page. When the admin opens the link, the reflected payload executes in the admin's browser and can silently issue background requests to create a new administrator account, achieving persistence.

php

// Source: https://github.com/Dolibarr/dolibarr/commit/3094b0aa3b500ff51020b660a7e66ffcb9d1cd91
// Vulnerable code (removed) and patched code (added) in
// htdocs/core/tpl/admin_extrafields_add.tpl.php

            langfile.removeAttr('disabled');
            required.removeAttr('disabled');
            alwayseditable.removeAttr('disabled');
            emptyonclone.removeAttr('disabled');
            list.removeAttr('disabled');
        }
    }
-   init_typeoffields('<?php echo GETPOST('type', 'alpha'); ?>');
+   init_typeoffields('<?php echo dol_escape_js(GETPOST('type', 'alpha')); ?>');
    jQuery("#type").change(function() {
        init_typeoffields($(this).val());
    });

The patch wraps the tainted parameter in dol_escape_js(), which escapes characters that would otherwise let an attacker break out of the JavaScript string literal.

Detection Methods for CVE-2026-71503

Indicators of Compromise

HTTP GET requests to Dolibarr admin extra fields endpoints containing a type parameter with quote characters, backslashes, or JavaScript keywords such as alert, fetch, or document.cookie.
Unexpected creation of administrator accounts with no corresponding manual action in Dolibarr audit logs.
Referrer headers pointing to external domains on requests that reach /admin/extrafields or /product/admin/product_extrafields.php.

Detection Strategies

Inspect web server access logs for the type query parameter carrying URL-encoded payloads such as %27, %3Bfetch%28, or %3Cscript.
Alert on POSTs to Dolibarr user management endpoints that originate from a browser session immediately after a suspicious admin-facing GET request.
Deploy a web application firewall rule matching reflected XSS patterns in the type parameter for Dolibarr URIs.

Monitoring Recommendations

Continuously audit privileged account creation events in Dolibarr and correlate them with the acting user's recent HTTP activity.
Monitor outbound requests from administrator browsers to unfamiliar domains that may serve payload stages.
Track patch state across Dolibarr instances to identify hosts still running versions prior to 24.0.0.

How to Mitigate CVE-2026-71503

Immediate Actions Required

Upgrade all Dolibarr instances to version 24.0.0 or later, which includes commit 3094b0aa3b500ff51020b660a7e66ffcb9d1cd91.
Review Dolibarr user tables for administrator accounts created without authorization and disable any unrecognized accounts.
Rotate credentials and session tokens for administrator accounts that may have interacted with untrusted links.

Patch Information

The fix is included in the Dolibarr 24.0.0 release via the security commit. The change applies dol_escape_js() to the type parameter before it reaches the inline script context. Additional detail is available in the VulnCheck advisory and the CodeAnt security research writeup.

Workarounds

Restrict access to Dolibarr administrative URIs to trusted IP ranges via reverse proxy or firewall rules until the upgrade is applied.
Deploy a strict Content-Security-Policy header that disallows inline script execution or restricts script sources to first-party origins.
Instruct administrators to avoid opening Dolibarr links from untrusted email or chat sources and to log out after administrative sessions.

bash

# Example nginx snippet to enforce CSP and restrict admin paths
location /htdocs/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
}

location ~* /(admin_extrafields_add|product_extrafields)\.php$ {
    allow 10.0.0.0/8;
    deny all;
}