{"id":"CVE-2026-112361","kind":"vulnerability","aliases":["CVE-2026-112361"],"related":[],"title":"Dolibarr: flaw in document.php lets remote attackers bypass CSP protection","description":"A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.","summary":"Dolibarr up to 23.0.2 has a flaw in htdocs/document.php in its CSP component that makes the protection mechanism fail. The sources say the attack can be run remotely, but they do not describe the exact bypass or what data an attacker reaches.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dolibarr","other","php","self-hosted"],"not_affected_if":[],"how_to_check":"- Check the installed Dolibarr version against `23.0.2` and earlier releases\n- unknown for any other check, the sources do not say how to test the affected code path","fix":"- Upgrade Dolibarr to `24.0.0`, the version the sources name as the fix; the referenced patch is commit `9f9ffa288d4ad2632c1d5dd88272c699a592f4ec`","status":"open","published_at":"2026-10-19T22:17:06+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:55:46+00:00","updated_at":"2026-10-25T03:55:46+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T03:55:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dolibarr to `24.0.0`, the version the sources name as the fix; the referenced patch is commit `9f9ffa288d4ad2632c1d5dd88272c699a592f4ec`","reach":"internet","title":"Dolibarr: flaw in document.php lets remote attackers bypass CSP protection","impact":"medium","summary":"Dolibarr up to 23.0.2 has a flaw in htdocs/document.php in its CSP component that makes the protection mechanism fail. The sources say the attack can be run remotely, but they do not describe the exact bypass or what data an attacker reaches.","category":"other","nicknames":[],"who_cares":["dolibarr","self-hosted","php"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; sources say only that CSP protection can fail remotely","analyst_note":"Find the advisory or commit 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec to confirm what the CSP bypass allows and whether authentication is required.","how_to_check":"- Check the installed Dolibarr version against `23.0.2` and earlier releases\n- unknown for any other check, the sources do not say how to test the affected code path","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running self-hosted Dolibarr at version 23.0.2 or earlier are in scope, since the flaw is in the web-facing document.php file. The sources do not say which configurations or roles are needed, so unknown whether hosted or single-user installs are safe to skip.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000629,"input_tokens":3363,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112361':13A,16A '-2026':12A,15A '23.0.2':26B,74C '24.0.0':106C '9f9ffa288d4ad2632c1d5dd88272c699a592f4ec':119C 'affect':124C 'attack':7A,46B,63B,98C 'bypass':8A,58B 'compon':35B,88C,125C 'csp':9A,34B,89C 'cve':11A,14A 'data':61B 'describ':55B 'document.php':4A 'dolibarr':1A,17B,23B,71C 'element':77C 'exact':57B 'execut':101C 'fail':41B 'failur':96C 'file':84C 'flaw':2A,29B 'found':69C 'function':81C 'host':22B 'htdocs/document.php':31B,85C 'impact':76C 'issu':112C 'lead':92C 'let':5A 'make':37B 'manipul':91C 'mechan':40B,95C 'name':114C 'patch':117C 'php':19B 'protect':10A,39B,94C 'reach':64B 'remot':6A,50B,102C 'resolv':110C 'run':49B 'say':44B 'self':21B 'self-host':20B 'sourc':43B 'suffici':108C 'unknown':80C 'upgrad':103C,122C 'version':105C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Dolibarr at version 23.0.2 or earlier are in scope, since the flaw is in the web-facing document.php file. The sources do not say which configurations or roles are needed, so unknown whether hosted or single-user installs are safe to skip.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112361","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112361","severity":null,"published_at":"2026-10-19T22:17:06+00:00","modified_at":"2026-10-20T14:16:56+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}