CVE-2026-81728

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0

Description A SQL injection exists in the CSV and XLSX import wizard. The issue occurs because the wizard reads update keys using the GETPOST('updatekeys','array') function in htdocs/imports/import.php, applying only a filter that removes HTML while leaving SQL keywords, quotes, and parentheses intact. Subsequently, the import insert() function in htdocs/core/modules/import/import csv.modules.php builds a filter where the $where[] variable is constructed using the submitted keys without proper validation against a legitimate list of column codes. This allows a user with import permissions to use a UNION SELECT statement to exfiltrate arbitrary table content or redirect which row is overwritten during an update. The vulnerability is triggered when the assembled string is executed via $this->db->query().

Recommendations Update to version 24.0.0 or later. As a temporary mitigation, restrict import permissions to only trusted users.