CVE-2026-31018 affects Dolibarr ERP & CRM versions up to and including 22.0.4. The issue lies in the Website module where enforcement of PHP code detection and editing permissions is not consistently applied across all input parameters. As a result, an authenticated user restricted to editing HTML/JavaScript can bypass these restrictions and inject PHP code during the creation of website pages. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is categorized under CWE-284 (Improper Access Control) and CWE-94 (Improper Control of Generation of Code). No official patch or remediation guidance is currently provided, and no known exploits in the wild have been reported.

An authenticated user with limited permissions to edit only HTML/JavaScript can escalate privileges to inject and execute arbitrary PHP code. This can lead to complete system compromise, including unauthorized data access, modification, and potential denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected Dolibarr ERP & CRM installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Website module to trusted users only and monitor for suspicious activity related to website page creation inputs. Avoid granting HTML/JavaScript editing permissions to untrusted users. Follow up with Dolibarr vendor advisories for updates on patches or official mitigations.