SQL injection in Dolibarr Third Party update via localtax parameters
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.
Summary
Dolibarr versions before 22.0.5 and from 23.0.0 before 23.0.2 are affected. The third-party company update functionality builds an SQL UPDATE statement from the localtax1_value and localtax2_value properties without numeric conversion or other sanitization (CWE-89). An authenticated user with third-party create or edit permission can read sensitive database data, including password hashes and API keys, or modify third-party records.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dolibarr | dolibarr | before 22.0.5; 23.0.0 to before 23.0.2 | 22.0.5, 23.0.2 | Patch available | CNA |
| — | dolibarr/dolibarr (Packagist) | before 22.0.5 | 22.0.5 | Patch available | GHSA-v5fq-cf5m-vwv7 |
| — | dolibarr/dolibarr (Packagist) | 23.0.0 to before 23.0.2 | 23.0.2 | Patch available | GHSA-v5fq-cf5m-vwv7 |
- dolibarr VendorDolibarr Affected before 22.0.5; 23.0.0 to before 23.0.2 Fixed in 22.0.5, 23.0.2 Patch available CNA
- dolibarr/dolibarr (Packagist) Vendor— Affected before 22.0.5 Fixed in 22.0.5 Patch available GHSA-v5fq-cf5m-vwv7
- dolibarr/dolibarr (Packagist) Vendor— Affected 23.0.0 to before 23.0.2 Fixed in 23.0.2 Patch available GHSA-v5fq-cf5m-vwv7
Remediation
Upgrade Dolibarr to version 22.0.5 for the 22 branch or to version 23.0.2 for the 23 branch. The Packagist package dolibarr/dolibarr is fixed in the same versions.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA dolibarr (Dolibarr) Fixed in 22.0.5, 23.0.2
- Fix · GHSA-v5fq-cf5m-vwv7 dolibarr/dolibarr (Packagist) Fixed in 22.0.5 Advisory →
- Fix · GHSA-v5fq-cf5m-vwv7 dolibarr/dolibarr (Packagist) Fixed in 23.0.2 Advisory →
Timeline
- 2026-11-05 Threatist record created from CVE-2026-33944
- 2026-11-05 Alias added: GHSA-v5fq-cf5m-vwv7
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 8
- https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7
- https://github.com/Dolibarr/dolibarr/pull/37632
- https://github.com/Dolibarr/dolibarr/commit/a06b14b7dc39d33f8fa00c9b27f2913b494885cb
- https://github.com/Dolibarr/dolibarr/commit/c83c13305240c2c0a3779e678b57238b32d15e7c
- https://github.com/Dolibarr/dolibarr/releases/tag/22.0.5
- https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2
- https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html
- https://github.com/Dolibarr/dolibarr
More Dolibarr vulnerabilities
- TI-2022-21049 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. CVSS 3.1CRITICAL 9.8
- TI-2022-03742 SQL Injection in dolibarr/dolibarr CVSS 3.1CRITICAL 9.8
- TI-2023-14191 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an… CVSS 3.1HIGH 8.8
- TI-2018-15582 Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php CVSS 4.0CRITICAL 9.3
- TI-2018-07157 SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute… CVSS 3.0CRITICAL 9.8
- TI-2019-15505 Dolibarr ERP/CRM 10.0.1 SQL Injection via elemid CVSS 4.0HIGH 8.8
Sources
- CVE-2026-33944 · CVE Program
- CVE-2026-33944 · NVD
- FIRST EPSS
- GHSA-v5fq-cf5m-vwv7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences