Read the docs
TI-2021-07961 Aliases CVE-2021-25955GHSA-cpv8-6xgr-rmf6

Stored XSS in “Dolibarr” leads to privilege escalation

Priority MEDIUM 41CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account takeover of the admin and due to other vulnerability (Improper Access Control on Private notes) a low privileged user can update the private notes which could lead to privilege escalation.

Why it matters now

EPSS 0.00893 59th percentileScored 2026-11-07
Fix Fixed dolibarr/dolibarr (Packagist): 14.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Dolibarrdolibarrup to v13.0.2; v2.8.1 and later—No fix listedCNA
—dolibarr/dolibarr (Packagist)2.8.1 to before 14.0.014.0.0Patch availableGHSA-cpv8-6xgr-rmf6
  • dolibarr VendorDolibarr Affected up to v13.0.2; v2.8.1 and later Fixed in — No fix listed CNA
  • dolibarr/dolibarr (Packagist) Vendor— Affected 2.8.1 to before 14.0.0 Fixed in 14.0.0 Patch available GHSA-cpv8-6xgr-rmf6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:*2.8.1 – 13.0.2VulnerableDolibarr
  • cpe:2.3:a:dolibarr:dolibarr:*:*:*:*:*:*:*:* Versions 2.8.1 – 13.0.2 Vulnerable ·Dolibarr

Remediation

  • Fix · GHSA-cpv8-6xgr-rmf6 dolibarr/dolibarr (Packagist) Fixed in 14.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25955
  2. 2026-10-03 Alias added: GHSA-cpv8-6xgr-rmf6

References

Patch 1

Advisory 2

Other 1

  • TI-2018-07157 SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
  • TI-2018-07158 Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers… CVSS 3.0MEDIUM 6.1
  • TI-2020-11130 Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types… CVSS 3.1HIGH 8.8
  • TI-2019-13844 Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen). CVSS 3.1CRITICAL 9.8
  • TI-2018-06539 SQL Injection vulnerability in Dolibarr before version 7.0.2 allows remote attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2018-12038 An issue was discovered in Dolibarr through 7.0.0. CVSS 3.0CRITICAL 9.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences