Dolibarr EUVD-2026-104654

Exploitation targets Dolibarr's document-serving endpoints (htdocs/document.php and htdocs/viewimage.php), where the Content-Security-Policy was set with form-action 'self' instead of the stricter form-action 'none', permitting form submissions from served content. Per the CVSS vector, PR:L indicates authenticated access to the Dolibarr application is required (not a default-unauthenticated remote exploit), and UI:N means no victim interaction is needed. The practical impact is limited because this is a weakened defense-in-depth control rather than a primary vulnerability - meaningful abuse generally requires a second content-injection flaw to place a malicious form into the served response, which constrains real-world exploitability.

This is a genuinely moderate-to-low priority issue, not a high-urgency flaw. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) yields a base score of 5.3 (Medium), with all three impact metrics rated Low and the exploitation code maturity left undefined (E:X). The underlying weakness (CWE-693, Protection Mechanism Failure) is corroborated by the source-code evidence: the patch merely tightens a Content-Security-Policy directive, changing form-action 'self' to form-action 'none' in htdocs/document.php and htdocs/viewimage.php - i.e., a hardening of a defense-in-depth control rather than a directly exploitable memory, injection, or auth-bypass bug. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and there is no POC reference; the only sources are VulDB entries and the GitHub patch. The signals are internally consistent (low-impact CSP weakening, requires authenticated access per PR:L) and none conflict, but the absence of EPSS/KEV means exploitation likelihood cannot be quantified - though the nature of the bug (a weakened CSP, not a primary vulnerability) strongly suggests low real-world risk absent a chainable secondary flaw.

An authenticated attacker who can influence content served through Dolibarr's document.php or viewimage.php endpoints could embed a form that submits to an attacker-controlled destination, because the pre-patch CSP permitted form-action 'self' rather than blocking it entirely. This serves as a defense-in-depth gap that could assist CSRF-style or data-exfiltration chains only if combined with another content-injection flaw. No public exploit identified at time of analysis.