CVE-2026-112361

MEDIUM 6.3

Dolibarr CSP document.php protection mechanism

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. Upgrading to version 24.0.0 is sufficient to resolve this issue. The name of the patch is 9f9ffa288d4ad2632c1d5dd88272c699a592f4ec. You should upgrade the affected component.

CWE	CWE-693
Vendor	n/a
Product	dolibarr
Published	Oct 19, 2026

Stay Ahead of the Next One

Get instant alerts for n/a dolibarr

Be the first to know when new medium vulnerabilities affecting n/a dolibarr are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / Dolibarr

23.0.0 23.0.1 23.0.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/422397 vuldb.com: https://vuldb.com/vuln/422397/cti vuldb.com: https://vuldb.com/cve/CVE-2026-112361 vuldb.com: https://vuldb.com/submit/990315 github.com: https://github.com/Dolibarr/dolibarr/commit/9f9ffa288d4ad2632c1d5dd88272c699a592f4ec github.com: https://github.com/Dolibarr/dolibarr/releases/tag/24.0.0 github.com: https://github.com/Dolibarr/dolibarr/

Credits

🔍 Mesh3l (VulDB User)