CVE-2024-55228 is a critical severity (CVSS 9.0) cross-site scripting flaw in the Product module of Dolibarr v21.0.0-beta, through the Title parameter. Dolibarr commits referenced in the record fix it, so move to a release that includes them and keep the pre-release off production systems.
What's affected
The record names Dolibarr ERP/CRM v21.0.0-beta as affected, in the Product module, through the Title parameter. It lists three Dolibarr commits as references, and one of them is titled as a fix for this CVE and for CVE-2024-55227.
The record does not name a fixed release. Check the Dolibarr release notes for the first stable version that includes the commits before you pick a target.
A beta build is a pre-release. If you run one on a live system, move to a stable release.
How to check if you're exposed
Read the version from the Dolibarr home page or the About screen.
grep -rn "DOL_VERSION" htdocs/filefunc.inc.php
If the version is 21.0.0-beta, treat it as affected. Review who can create and edit products and services, because that is where the title is entered. Look at existing product titles for markup that should not be there.
What to do now
- Check the Dolibarr version on every installation.
- Move off 21.0.0-beta to a stable release that includes the fix commits.
- Review user permissions for product creation and editing.
- Add a content security policy to the web server if you can.
- Search existing product records for titles that contain markup, and clean them up.
Why it matters
The weakness is CWE-79 (Cross-site Scripting). A field entered by one user is shown to others without encoding, so markup in it is treated as part of the page. Script in a product title runs in the browser of every person who opens that product, with that person rights.
Product records are shown on many screens and in lists, which spreads the reach. The fix is output encoding applied in one shared helper so that no screen is forgotten, and the fix commits move in that direction. The record does not flag exploitation, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-55228.
Quick check
Which module is affected?
The Product module, through the Title parameter.
Is a stable Dolibarr release affected?
The record names v21.0.0-beta. Check the release notes for the stable versions that carry the fix.
Sources
- Dolibarr fix commit (listed in the NVD record)
- Dolibarr security policy
- Gold entry for CVE-2024-55228
Last reviewed: 19 October 2026.
