CVE-2026-7688: Dolibarr ERP CRM Shipments API Endpoint expedition.class.php _checkValForAPI sql injection
A vulnerability was identified in Dolibarr ERP CRM up to 23.0.2. This affects the function checkValForAPI of the file htdocs/expedition/class/expedition.class.php of the component Shipments API Endpoint. The manipulation of the argument fields leads to sql injection. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. It is indicated that the exploitability is difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7688?
CVE-2026-7688 is classified as a high severity SQL injection vulnerability impacting Dolibarr ERP CRM versions up to 23.0.2.
How do I fix CVE-2026-7688?
To fix CVE-2026-7688, update Dolibarr ERP CRM to the latest version beyond 23.0.2 where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-7688?
CVE-2026-7688 is an SQL injection vulnerability that affects the _checkValForAPI function in the Shipments API Endpoint.
Which versions of Dolibarr ERP CRM are affected by CVE-2026-7688?
CVE-2026-7688 affects all versions of Dolibarr ERP CRM up to and including 23.0.2.
What component of Dolibarr ERP CRM is impacted by CVE-2026-7688?
CVE-2026-7688 impacts the Shipments API Endpoint, specifically the function found in expedition.class.php.