CVE-2026-110874 Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
Attackers with write access to specific fields can inject serialized PHP objects to achieve code execution or file manipulation in Dolibarr.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-110874?
CVE-2026-110874 is a high-severity unsafe deserialization vulnerability in dolibarr, published on 15 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
Weakness: CWE-502
Which versions are affected by CVE-2026-110874?
How do I fix CVE-2026-110874?
No fix has been published for CVE-2026-110874 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-110874 being exploited?
There is no known exploitation of CVE-2026-110874 in the wild and no public exploit code.
Sources
Also known as GHSA-52qw-6h47-qw3w.