PT-2026-33981

CVE-2026-31018

Published

2026-04-21

Updated

2026-04-22

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5

Description In the Website module, PHP code detection and editing permission enforcement is not applied consistently to all input parameters. This allows an authenticated user who is restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during the creation of website pages.

Recommendations Update to a version newer than 22.0.4.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers

CVE-2026-31018