6.6
MediumCVSS 3.1 · from VulnCheck
CVE-2026-110874
Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
dolibarr · Unsafe deserialization · CWE-502Affecteddolibarr
FixUpdate to 23.0.4 or newer
PublishedOct 15, 18:57 · VulnCheck
ScoredOct 15 · 6.6 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:08 UTC
What we know
No known exploitation. CISA KEV, checked 22:08 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed indolibarrbefore 23.0.423.0.4dolibarrNot affected23.0.4
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known