CVE•Published 2026-04-17•Modified 2026-05-01•1 article on news•7 live references•NVD data

CVE-2026-23500Dolibarr · Dolibarr_erp\/crm

Vulnerability data via NVD (ingested)

CVSS v3.1

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 65% of all CVEs

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Description

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.

Timeline

Published 2026-04-17

Modified 2026-05-01

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-23500

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Dolibarr Dolibarr Erp\/crm"

All exposed Dolibarr Dolibarr Erp\/crm instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Dolibarr Erp\/crm"

HTTP body or banner mentions "Dolibarr Erp\/crm" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-23500