CVE-2026-23500 Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
An authenticated administrator can achieve remote code execution by injecting OS commands into the ODT to PDF conversion configuration setting.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23500?
CVE-2026-23500 is a critical command injection vulnerability in Dolibarr Dolibarr Erp\/Crm, published on 17 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-23500?
2 open source packages ship an affected version, including dolibarr/dolibarr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
dolibarr/dolibarr Packagist | All versions to 22.0.4 | None |
dolibarr/dolibarr Packagist | All versions to 22.0.4 | None |
Products include Dolibarr Dolibarr Erp\/Crm.
How do I fix CVE-2026-23500?
No fix has been published for CVE-2026-23500 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-23500 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23500 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Dolibarr Dolibarr Erp\/Crm
Sources
Also known as GHSA-w5j3-8fcr-h87w, UBUNTU-CVE-2026-23500.