---
id: "CVE-2026-112361"
kind: "vulnerability"
aliases: ["CVE-2026-112361"]
title: "Dolibarr: flaw in document.php lets remote attackers bypass CSP protection"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["dolibarr", "other", "php", "self-hosted"]
not_affected_if: []
published_at: "2026-10-19T22:17:06+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:55:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112361", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Dolibarr: flaw in document.php lets remote attackers bypass CSP protection

Dolibarr up to 23.0.2 has a flaw in htdocs/document.php in its CSP component that makes the protection mechanism fail. The sources say the attack can be run remotely, but they do not describe the exact bypass or what data an attacker reaches.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dolibarr version against `23.0.2` and earlier releases
- unknown for any other check, the sources do not say how to test the affected code path

## Fix

- Upgrade Dolibarr to `24.0.0`, the version the sources name as the fix; the referenced patch is commit `9f9ffa288d4ad2632c1d5dd88272c699a592f4ec`

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112361

## From the sources

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_