Threats affecting pkg:github/dolibarr

CVE-2026-58376 is a SQL injection vulnerability in Dolibarr versions up to 23.0.3. It affects authenticated API users who can exploit the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints to exfiltrate arbitrary database contents. The flaw arises because the endpoints validate sqlfilters only for balanced parentheses and rewrite matched triplets, but allow appended SQL commands such as UNION SELECT to be concatenated unmodified into the SQL WHERE clause. This enables attackers to retrieve sensitive data including password hashes and API keys. The vulnerability is rated high severity with a CVSS score of 7.6. A fix was introduced in commit 14db36e after version 23.0.3.