CVE-2026-23500 is a critical command injection flaw (CVSS 9.1) in Dolibarr ERP and CRM. During ODT to PDF conversion, a configuration setting is added to a shell command without sanitizing, so an authenticated administrator can run operating system commands as the web server user. Dolibarr 23.0.0 fixes it.
What's affected
Dolibarr versions before 23.0.0 are affected. The GitHub advisory lists affected versions up to 22.0.4 and the patched version as 23.0, which the record gives as 23.0.0.
The attacker needs an administrator account. That limits the exposure compared with an unauthenticated flaw, but admin accounts are a common target and are shared more widely than they should be in many small companies.
How to check if you're exposed
Read the version in the Dolibarr interface under the About or Home page, or from the application files:
grep -r "DOL_VERSION" htdocs/filefunc.inc.php
Then look at who holds administrator rights and whether any admin account uses a weak or reused password. Finally, check the value of the MAIN_ODT_AS_PDF setting in the Setup, Other setup area, or in the database table of configuration constants. It should be empty or a known path to a conversion tool, with nothing added after it.
What to do now
- Upgrade Dolibarr to 23.0.0 or later.
- Review the MAIN_ODT_AS_PDF setting and reset it if it holds anything unexpected.
- Reduce the number of administrator accounts and enforce strong, unique passwords.
- Check the web server for files or scheduled jobs you did not create.
- Run the web server as a low privileged user with minimal file access.
Why it matters
The class is CWE-78 (OS Command Injection). The application builds a shell command by joining a stored setting with a file name. The file name is escaped, the setting is not, so whoever controls the setting controls the command.
Settings stored in a database are easy to forget when thinking about input. They feel trusted, but anyone who can change them, through the admin screen or through another flaw such as SQL injection, can turn them into commands. The safe approach is to avoid the shell, pass arguments as a list, and validate configured paths against an allow list. The record does not mark this CVE as exploited in the wild.
Quick check
Do I need to be an admin to exploit this?
Yes. The advisory says an authenticated administrator can inject commands.
Why is it still rated critical?
The result is operating system command execution, and scope and impact scores are high even with an admin requirement.
Sources
Last reviewed: 19 October 2026.
