CVE-2024-55227 is a critical severity (CVSS 9.0) cross-site scripting flaw in the Events/Agenda module of Dolibarr v21.0.0-beta, through the Title parameter. Dolibarr commits referenced in the record fix it, so move to a release that includes them and keep the pre-release off production systems.
What's affected
The record names Dolibarr ERP/CRM v21.0.0-beta as affected, in the Events/Agenda module, through the Title parameter. It lists three Dolibarr commits as references. One is titled as a fix for this CVE and for CVE-2024-55228.
The record does not name a fixed release, so check the Dolibarr release notes for the first stable version that includes the commits before you decide on a target.
A beta build is a pre-release. If you are running one on a live system, move to a stable release.
How to check if you're exposed
Read your version from the Dolibarr home page or the About screen.
grep -rn "DOL_VERSION" htdocs/filefunc.inc.php
If the version is 21.0.0-beta, treat it as affected. Review who can create and edit agenda events, since that is where the title is entered, and look at existing event titles for markup that should not be there.
What to do now
- Check the Dolibarr version on every installation.
- Move off 21.0.0-beta to a stable release that includes the fix commits.
- Review user permissions for agenda event creation.
- Add a content security policy to the web server if you can.
- Search existing events for titles that contain markup, and clean them up.
Why it matters
The weakness is CWE-79 (Cross-site Scripting). The application inserts a field into a page without encoding it, so markup in the field is treated as part of the page, and script in it runs in the browser of whoever views the page. In an ERP system, viewers include administrators with wide rights.
The score of 9.0 reflects the changed scope, since script in the browser can act on the whole application with the rights of the viewer. The fix is output encoding for every place user input is shown. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-55227.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which module is affected?
The Events/Agenda module, through the Title parameter.
Is this the same as CVE-2024-55228?
They are separate CVEs, one for the Agenda module and one for the Product module, and one commit title mentions both.
Sources
- Dolibarr fix commit (listed in the NVD record)
- Dolibarr security policy
- Gold entry for CVE-2024-55227
Last reviewed: 19 October 2026.
