Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. (CVE-2026-81728)

The SQL injection in Dolibarr before 24.0.0 occurs in the CSV and XLSX import wizard. The import process reads update keys using GETPOST('updatekeys', 'array') with only a generic alphanohtml filter that removes HTML but leaves SQL syntax elements intact. The import_insert() function builds a SQL WHERE clause from these keys without proper validation against a fixed list of legitimate column codes. This allows an attacker with import permissions to inject UNION SELECT statements that can exfiltrate arbitrary table content and control which database rows are updated. The vulnerability is addressed in Dolibarr 24.0.0 by adding an allow-list validation for submitted values.

An attacker with import permissions can exploit this vulnerability to perform SQL injection attacks, leading to unauthorized data disclosure and modification of arbitrary database rows. The vulnerability has a high severity score (CVSS 8.1) with impacts on confidentiality and integrity but no impact on availability. There are no known exploits in the wild at this time.

A fix is available in Dolibarr version 24.0.0, which adds an allow-list check to validate submitted update keys in the import wizard. Users should upgrade to version 24.0.0 or later to remediate this vulnerability. Until upgraded, restrict import permissions to trusted users only.