CVE-2026-110874: Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Q: Who is realistically exposed to exploitation?

Instances running Dolibarr before 23.0.4 are exposed if an attacker has sufficient privileges or another means to write stored extrafields, export configurations, or blocked log entries.

Q: What does an attacker need to exploit this issue?

The attacker must be able to plant serialized PHP object data in one of the affected stored inputs. Exploitation also depends on a usable gadget chain being available to trigger code execution or file manipulation.

Q: Are default installations affected?

The provided information identifies affected versions before 23.0.4, but does not establish whether the vulnerable data-writing paths are available to an unprivileged user in a default configuration.

Q: How can I tell whether my instance is affected?

Check whether the Dolibarr version is earlier than 23.0.4. Also review access to stored extrafields, export configurations, and blocked log entries, since these are identified as locations where malicious serialized objects can be planted.

Q: What should be done if immediate patching is not possible?

Restrict and audit the ability to write stored extrafields, export configurations, and blocked log entries. Treat unexpected serialized data in those locations as suspicious, because it may be processed by jsonOrUnserialize() when JSON decoding fails.

Published Oct 15, 2026

Updated

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when jsondecode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

Affected Software

1 affected component

dolibarr Dolibarr<23.0.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Dolibarr to a version that resolves this vulnerability.
Fixed in 23.0.4

Event History

Oct 15, 2026

CVE Published

via MITRE·06:57 PM

Data Sourced

via MITRE·06:57 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to exploitation?

Instances running Dolibarr before 23.0.4 are exposed if an attacker has sufficient privileges or another means to write stored extrafields, export configurations, or blocked log entries.

What does an attacker need to exploit this issue?

The attacker must be able to plant serialized PHP object data in one of the affected stored inputs. Exploitation also depends on a usable gadget chain being available to trigger code execution or file manipulation.

Are default installations affected?

The provided information identifies affected versions before 23.0.4, but does not establish whether the vulnerable data-writing paths are available to an unprivileged user in a default configuration.

How can I tell whether my instance is affected?

Check whether the Dolibarr version is earlier than 23.0.4. Also review access to stored extrafields, export configurations, and blocked log entries, since these are identified as locations where malicious serialized objects can be planted.

What should be done if immediate patching is not possible?

Restrict and audit the ability to write stored extrafields, export configurations, and blocked log entries. Treat unexpected serialized data in those locations as suspicious, because it may be processed by jsonOrUnserialize() when JSON decoding fails.

CVE-2026-110874: Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to exploitation?

What does an attacker need to exploit this issue?

Are default installations affected?

How can I tell whether my instance is affected?

What should be done if immediate patching is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to exploitation?

What does an attacker need to exploit this issue?

Are default installations affected?

How can I tell whether my instance is affected?

What should be done if immediate patching is not possible?