CVE-2026-31018: n/a
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.
AI Analysis
Technical Summary
In Dolibarr ERP & CRM versions up to 22.0.4, the Website module fails to consistently enforce PHP code detection and editing permissions across all input parameters. As a result, an authenticated user restricted to HTML/JavaScript editing can bypass these restrictions and inject PHP code through certain unprotected inputs during website page creation. This vulnerability arises from inconsistent permission checks rather than a flaw in authentication itself. No CVSS score or official remediation information is provided.
Potential Impact
An authenticated user with limited editing permissions can escalate their capabilities to inject PHP code, potentially leading to unauthorized code execution within the application context. This could compromise the integrity and security of the affected Dolibarr instance. However, exploitation requires authentication and the ability to create or edit website pages.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict website page creation and editing permissions to trusted users only and monitor for suspicious activity related to website content management. Avoid granting HTML/JavaScript editing permissions broadly.
CVE-2026-31018: n/a
Description
In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Dolibarr ERP & CRM versions up to 22.0.4, the Website module fails to consistently enforce PHP code detection and editing permissions across all input parameters. As a result, an authenticated user restricted to HTML/JavaScript editing can bypass these restrictions and inject PHP code through certain unprotected inputs during website page creation. This vulnerability arises from inconsistent permission checks rather than a flaw in authentication itself. No CVSS score or official remediation information is provided.
Potential Impact
An authenticated user with limited editing permissions can escalate their capabilities to inject PHP code, potentially leading to unauthorized code execution within the application context. This could compromise the integrity and security of the affected Dolibarr instance. However, exploitation requires authentication and the ability to create or edit website pages.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict website page creation and editing permissions to trusted users only and monitor for suspicious activity related to website content management. Avoid granting HTML/JavaScript editing permissions broadly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-03-09T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e78a2b19fe3cd2cdda97f8
Added to database: 4/21/2026, 2:31:07 PM
Last enriched: 4/21/2026, 2:46:17 PM
Last updated: 4/21/2026, 4:59:13 PM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.