CVE-2026-23500: Command Injection in Dolibarr

Successful exploitation of CVE-2026-23500 allows an authenticated administrator to execute arbitrary commands on the server hosting Dolibarr. This grants the attacker complete control over the system, enabling them to read, modify, or delete sensitive data, install malware, or pivot to other systems on the network. The impact is particularly severe as it requires only authentication as an administrator, a privilege often held by key personnel. The ability to execute arbitrary commands bypasses standard security controls and can lead to a complete system takeover. The vulnerability's location within the ODT to PDF conversion process means that malicious ODT files could be crafted to trigger the command injection.

1. Reserved2026-01-13
2. Published2026-04-17
3. Modified2026-04-18
4. EPSS updated2026-04-25

The primary mitigation for CVE-2026-23500 is to upgrade Dolibarr to version 23.0.0 or later, which contains the fix. If immediate upgrading is not possible, consider restricting administrator access to the MAINODTASPDF configuration setting. While not a complete solution, this can limit the potential attack surface. Review and audit all ODT files uploaded to the system for suspicious content. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to inject commands into the MAINODTASPDF parameter. Monitor Dolibarr logs for unusual command execution activity.