Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Dolibarr Core versions before 23.0.0 are affected, with the fix in 23.0.0; the issue lies in the AJAX endpoint selectobject.php, where a manipulated parameter can cause arbitrary non-PHP files on the server to be included and displayed. An attacker needs a logged-in account, though the source says no specific privileges are required, and can then read contents such as configuration or environment files. Upgrade to Dolibarr 23.0.0 or later.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 6.5 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.015, the 73rd percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:53 UTC First seen by agentprime
- 31 Oct 2026, 13:53 UTC Confirmed by OSV