CVE-2026-110874

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 23.0.4

Description A PHP object injection issue exists in the jsonOrUnserialize() function within functions.lib.php. The problem occurs when json decode() fails, leading the system to call unserialize() without class restrictions. Attackers who can write stored extrafields, export configurations, or blocked log entries can inject serialized objects to trigger gadget chains, potentially resulting in remote code execution or unauthorized file manipulation.

Recommendations Update to version 23.0.4 or later. As a temporary mitigation, restrict permissions to prevent unauthorized writing to extrafields, export configurations, and log entries.