GHSA-2852-jv28-2mv8
Dolibarr versions through 23.0.3 contain a SQL injection vulnerability in the setup and multicurrencies REST API endpoints. Authenticated API users can exploit this by supplying malicious values to the sqlfilters query parameter, enabling exfiltration of arbitrary database contents including sensitive data such as password hashes and API keys. The vulnerability arises because the endpoints only validate balanced parentheses and rewrite matched triplets, allowing appended SQL code like UNION SELECT to be injected into the SQL WHERE clause. This issue was fixed in commit 14db36e.
AI Analysis
Technical Summary
Dolibarr through version 23.0.3 has a SQL injection vulnerability (CWE-89) in api_setup.class.php and api_multicurrencies.class.php. The affected REST API endpoints validate the sqlfilters parameter only for balanced parentheses and rewrite matched triplets, but do not properly sanitize text outside this pattern. This allows an authenticated API user to append arbitrary SQL, such as UNION SELECT statements, into the WHERE clause of SQL queries. Exploitation can lead to unauthorized retrieval of sensitive database contents including password hashes and API keys. The vulnerability is fixed in commit 14db36e.
Potential Impact
An authenticated API user can exploit this vulnerability to perform SQL injection attacks, enabling exfiltration of arbitrary database contents. This includes sensitive information such as password hashes and API keys, potentially compromising system security and user data confidentiality.
Mitigation Recommendations
A fix is available and implemented in commit 14db36e. Users should update Dolibarr to a version that includes this commit or later to remediate the vulnerability. No additional mitigation guidance is provided in the advisory.
GHSA-2852-jv28-2mv8
Description
Dolibarr versions through 23.0.3 contain a SQL injection vulnerability in the setup and multicurrencies REST API endpoints. Authenticated API users can exploit this by supplying malicious values to the sqlfilters query parameter, enabling exfiltration of arbitrary database contents including sensitive data such as password hashes and API keys. The vulnerability arises because the endpoints only validate balanced parentheses and rewrite matched triplets, allowing appended SQL code like UNION SELECT to be injected into the SQL WHERE clause. This issue was fixed in commit 14db36e.
CVSS v4.0
Affected software
pkg:github/dolibarr/dolibarrRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Dolibarr through version 23.0.3 has a SQL injection vulnerability (CWE-89) in api_setup.class.php and api_multicurrencies.class.php. The affected REST API endpoints validate the sqlfilters parameter only for balanced parentheses and rewrite matched triplets, but do not properly sanitize text outside this pattern. This allows an authenticated API user to append arbitrary SQL, such as UNION SELECT statements, into the WHERE clause of SQL queries. Exploitation can lead to unauthorized retrieval of sensitive database contents including password hashes and API keys. The vulnerability is fixed in commit 14db36e.
Potential Impact
An authenticated API user can exploit this vulnerability to perform SQL injection attacks, enabling exfiltration of arbitrary database contents. This includes sensitive information such as password hashes and API keys, potentially compromising system security and user data confidentiality.
Mitigation Recommendations
A fix is available and implemented in commit 14db36e. Users should update Dolibarr to a version that includes this commit or later to remediate the vulnerability. No additional mitigation guidance is provided in the advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-2852-jv28-2mv8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-58376"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a4452e227e9c797198e126b
Added to database: 06/30/2026, 23:36:02 UTC
Last enriched: 06/30/2026, 23:49:04 UTC
Last updated: 07/01/2026, 01:07:25 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.