Live › vulnerability › CVE-2026-112361
Go to dashboardDolibarr up to 23.0.2 has a flaw in htdocs/document.php in its CSP component that makes the protection mechanism fail. The sources say the attack can be run remotely, but they do not describe the exact bypass or what data an attacker reaches.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Dolibarr at version 23.0.2 or earlier are in scope, since the flaw is in the web-facing document.php file. The sources do not say which configurations or roles are needed, so unknown whether hosted or single-user installs are safe to skip.
No product ranges from the sources yet.
23.0.2 and earlier releases24.0.0, the version the sources name as the fix; the referenced patch is commit 9f9ffa288d4ad2632c1d5dd88272c699a592f4ecEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-112361")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.