Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Dolibarr (dolibarr/dolibarr on Packagist) versions up to and including 23.0.0 are affected by a SQL injection in the Third Party update code in societe/class/societe.class.php, where the localtax1_value parameter is concatenated into an UPDATE statement without escaping or type casting. An attacker with a standard account that has Third Party create/edit permission can submit a crafted value to read database contents, such as password hashes, and potentially modify records. The source lists no fixed version, and the description does not give a patch or workaround.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.8 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 27 Oct 2026, 13:29 UTC Confirmed by GitHub Advisory Database
- 27 Oct 2026, 13:29 UTC Confirmed by Packagist
- 31 Oct 2026, 13:53 UTC First seen by agentprime
- 31 Oct 2026, 13:53 UTC Confirmed by OSV
- 5 Nov 2026, 21:40 UTC Confirmed by the CVE List
- 5 Nov 2026, 22:18 UTC Confirmed by NVD
Sources
- GitHub Advisory Database: GHSA-v5fq-cf5m-vwv7
- OSV: GHSA-v5fq-cf5m-vwv7
- github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7
- github.com/Dolibarr/dolibarr/commit/a06b14b7dc39d33f8fa00c9b27f2913b494885cb
- github.com/Dolibarr/dolibarr/commit/c83c13305240c2c0a3779e678b57238b32d15e7c
- github.com/Dolibarr/dolibarr
- github.com/Dolibarr/dolibarr/releases/tag/22.0.5
- github.com/Dolibarr/dolibarr/releases/tag/23.0.2
- www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html