CVE-2026-110874

MEDIUM 6.6

Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

CVSS Score

6.6

EPSS Score

0.0%

EPSS Percentile

0th

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

CWE	CWE-502
Vendor	dolibarr
Product	dolibarr
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for dolibarr dolibarr

Be the first to know when new medium vulnerabilities affecting dolibarr dolibarr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Dolibarr / dolibarr

0 < 23.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/Dolibarr/dolibarr/pull/38530 github.com: https://github.com/Dolibarr/dolibarr/commit/17658fcaefdaabe13685e566e5f12d5fbd4f4a5c github.com: https://github.com/Dolibarr/dolibarr vulncheck.com: https://www.vulncheck.com/advisories/dolibarr-before-23.0.4-php-object-injection-via-jsonorunserialize

Credits

XananasX7