Dolibarr CVE-2026-81728

Exploitation requires an authenticated Dolibarr session with the import permission explicitly granted to the user account; unauthenticated network access alone is insufficient to reach the vulnerable code path. The attack targets the CSV and XLSX import wizard at htdocs/imports/import.php, which must be network-reachable. No non-default Dolibarr configuration is required - the vulnerability is present in the standard import workflow on all pre-24.0.0 installations. The primary limiting factor is the import permission: deployments that restrict this permission to a small tier of trusted administrators face substantially lower real-world risk than those that grant it to broader user populations. Exploitation is not possible on Dolibarr 24.0.0 or later.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately captures the core threat profile: the import wizard is network-accessible, the injection requires no unusual complexity, and the combined confidentiality and integrity impact is high. The most consequential limiting factor is PR:L - exploitation requires a Dolibarr account with the import permission, which rules out unauthenticated mass scanning and restricts the realistic attacker pool to insiders, compromised credentials, or credential-stuffing attacks targeting Dolibarr logins. No EPSS score was supplied and the vulnerability is absent from the CISA KEV catalog, so real-world exploitation rates cannot be quantified. The dual-impact nature of the flaw - UNION SELECT exfiltration chained with UPDATE redirection - elevates practical severity beyond a typical read-only SQL injection; the direct injection of the filter array into UPDATE statements for category link tables introduces an additional integrity risk not captured by examining confidentiality alone. Organizations that grant the import permission broadly to non-administrative users face substantially greater exposure than those that restrict it tightly, and the absence of a 23.x backport means any pre-24.0.0 deployment remains vulnerable until a full version upgrade is completed.

An attacker who controls or has compromised a Dolibarr account with the import permission initiates a CSV import and submits a crafted updatekeys POST array where one entry is a UNION SELECT payload rather than a legitimate column code. The server processes the payload without allowlist validation, executes the injected SQL against the database, and returns an attacker-chosen integer as the resolved row identifier - redirecting the subsequent UPDATE to an arbitrary row while the UNION SELECT result leaks content from any table the database user can access. No public exploit code has been identified, but the attack requires only a crafted HTTP POST request.