CVE-2026-11619: Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. The impacted element is an unknown function of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy Filemanager. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 23.0.3 is sufficient to resolve this issue. The identifier of the patch is f1b2dd6481e22cacb561d29ffdcd3a50b618479d. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Dolibarr ERP CRM Legacy Filemanagerto a version that resolves this vulnerability.Fixed in 23.0.3Patch f1b2dd6481e22cacb561d29ffdcd3a50b618479d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11619?
The severity of CVE-2026-11619 is low with a score of 2.1.
How do I fix CVE-2026-11619?
To fix CVE-2026-11619, ensure that you update Dolibarr ERP CRM to version 23.0.3 or later where the vulnerability is patched.
What is impacted by CVE-2026-11619?
CVE-2026-11619 affects the config.inc.php file within the Legacy Filemanager component of Dolibarr ERP CRM.
What kind of vulnerability is CVE-2026-11619?
CVE-2026-11619 is classified as an improper authorization vulnerability.
Is it possible to exploit CVE-2026-11619 remotely?
Yes, CVE-2026-11619 can be exploited remotely as it allows unauthorized access through the affected file manager component.