CVE-2026-31018: In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input…

PriorityP349high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.29%

20.6th percentile

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
dolibarr	dolibarr	0 – 15.0.3	—
dolibarr	dolibarr_erp_crm	<= 22.0.4	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.