Which versions of PHP are affected by CVE-2026-23500?

Dolibarr ERP/CRM versions before 23.0.0 contain a critical command injection vulnerability in PDF template conversion that allows authenticated administrators to execute arbitrary system commands…. A patch is available.

How to fix or mitigate CVE-2026-23500?

Within 24 hours: Identify all Dolibarr instances and document current versions. Within 7 days: Upgrade all Dolibarr ERP/CRM deployments to version 23.0.0 or later. Within 30 days: Conduct access review of administrative accounts and implement principle of least privilege for administrator roles; enable audit logging for template conversion operations.

PHP CVE-2026-23500

Q: What is the CVSS score of CVE-2026-23500?

CVE-2026-23500 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-23502 CRITICAL

OS Command Injection (CWE-78)

2026-04-17 GitHub_M

GHSA-w5j3-8fcr-h87w

PHP Command Injection RCE

9.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch released

May 01, 2026 - 18:28 nvd

Patch available

Re-analysis Queued

Apr 20, 2026 - 19:07 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 23:48 vuln.today

Patch available

Apr 17, 2026 - 21:16 EUVD

EUVD ID Assigned

Apr 17, 2026 - 20:45 euvd

EUVD-2026-23502

Analysis Generated

Apr 17, 2026 - 20:45 vuln.today

CVE Published

Apr 17, 2026 - 20:25 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.

AnalysisAI

Command injection in Dolibarr ERP/CRM versions before 23.0.0 allows authenticated administrators to execute arbitrary operating system commands during ODT-to-PDF template conversion. The vulnerability stems from unsanitized concatenation of the MAIN_ODT_AS_PDF configuration constant into shell commands in odf.php. Exploitation requires administrative privileges (PR:H) but can be executed remotely (AV:N) with low complexity (AC:L), resulting in full system compromise as the web server user. Fixed in version 23.0.0. EPSS data not available; no public exploit identified at time of analysis.

Technical ContextAI

Dolibarr's ODT (OpenDocument Text) template processing mechanism converts documents to PDF by invoking external system commands via PHP's exec() function. The odf.php module constructs these commands by directly concatenating the MAIN_ODT_AS_PDF configuration setting without input validation or escaping. This is a classic CWE-78 (OS Command Injection) vulnerability where untrusted input flows into a shell command interpreter. Administrators can modify the MAIN_ODT_AS_PDF constant through the application's configuration interface. By injecting shell metacharacters (such as semicolons, pipes, or command substitution operators), attackers can append arbitrary commands that execute with the privileges of the web server process (typically www-data, apache, or nginx user). The vulnerability affects all Dolibarr installations prior to version 23.0.0 across all platforms where the ODT template feature is enabled.

RemediationAI

Upgrade to Dolibarr version 23.0.0 or later, which implements proper input sanitization for the MAIN_ODT_AS_PDF configuration constant. The patched version is available from the official GitHub repository at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0. If immediate patching is not feasible, implement compensating controls: disable ODT template generation functionality by restricting access to odf.php at the web server level (e.g., Apache/Nginx configuration blocking the specific endpoint), which prevents exploitation but breaks ODT-to-PDF conversion features for all users; apply strict web application firewall (WAF) rules to detect and block shell metacharacters in configuration settings, though this may be bypassed with encoding techniques; or limit administrative access to only trusted IP addresses via firewall rules and enforce multi-factor authentication for all admin accounts to reduce credential compromise risk. Each workaround has operational impact on either functionality or administrative workflows, making version upgrade the preferred solution. Review system logs for suspicious exec() calls or unexpected child processes spawned by the web server as indicators of prior exploitation.