CVE-2026-110874: Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()

Severity: medium (CVSS 6.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-15
Weakness: CWE-502

Description

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

Affected products

dolibarr: before 23.0.4 — fixed in 23.0.4

How to fix

Upgrade to a fixed version: dolibarr 23.0.4. Check the vendor advisory for mitigations.

References

https://github.com/Dolibarr/dolibarr
https://github.com/Dolibarr/dolibarr/commit/17658fcaefdaabe13685e566e5f12d5fbd4f4a5c
https://github.com/Dolibarr/dolibarr/pull/38530
https://www.vulncheck.com/advisories/dolibarr-before-23.0.4-php-object-injection-via-jsonorunserialize

Get alerted when CVE-2026-110874 or the next vulnerability affects your stack