CVE-2026-31018: 
PHP vulnerability analysis and mitigation

CVE-2026-31018 is a PHP code injection vulnerability in the Website module of Dolibarr ERP & CRM that allows authenticated low-privileged users to execute arbitrary PHP code on the server. It affects all versions of Dolibarr ERP/CRM up to and including 22.0.4, and was reported to the vendor on February 6, 2026, with the CVE assigned on April 7, 2026, and publicly disclosed on April 21, 2026. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, Researcher PoC).

The root cause is improper access control (CWE-284) combined with code injection (CWE-94): Dolibarr's Website module defines four permission levels — read, HTML/JS edit, PHP/dynamic edit, and delete — but the PHP code detection and permission enforcement logic is not consistently applied to all input parameters during page creation. Specifically, when a user selects "Create page from scratch or from a page template," certain input fields bypass the PHP restriction check, allowing a user with only read (level 1) or HTML/JS editing (level 2) permissions to inject PHP code into those unprotected parameters. This results in server-side execution of attacker-controlled PHP code (Researcher PoC, GitHub Advisory).

Successful exploitation allows an authenticated attacker with minimal privileges to achieve remote code execution (RCE) on the server, resulting in full compromise of confidentiality, integrity, and availability. Attackers can execute arbitrary system commands, access or exfiltrate sensitive ERP/CRM data (including financial records, customer data, and credentials), modify or delete website content, and potentially use the compromised server as a pivot point for lateral movement within the internal network (Researcher PoC, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.044% (15th percentile), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Dolibarr ERP/CRM instance running version 22.0.4 or earlier with the Website module enabled. Obtain or create a low-privileged account with at least read (level 1) or HTML/JS editing (level 2) permissions on the Website module.
2. Access the Website module: Log in to the Dolibarr instance and navigate to the Website module.
3. Initiate page creation: Select the option to "Create page from scratch" or "Create page from a page template" within the Website module.
4. Inject PHP payload: In the page creation form, identify input parameters that are not subject to PHP code detection enforcement (unprotected fields). Insert a malicious PHP payload (e.g., <?php system($_GET['cmd']); ?>) into these fields.
5. Save and trigger execution: Submit the page creation form. The injected PHP code is saved to the server without restriction.
6. Execute arbitrary commands: Access the newly created page via the web browser or HTTP request, appending a command parameter (e.g., ?cmd=id) to trigger server-side PHP execution and achieve RCE (Researcher PoC).

• Network: Unusual HTTP POST requests to Dolibarr Website module page creation endpoints (e.g., /website/index.php) from low-privileged user accounts; outbound connections from the web server to unknown external IPs following page creation events.
• File System: Newly created PHP files in the Dolibarr website content directory containing obfuscated or unexpected PHP code (e.g., system(), exec(), shell_exec(), passthru(), eval() calls); web shell files placed in publicly accessible directories.
• Logs: Dolibarr application logs showing page creation activity by users with only HTML/JS editing permissions; web server access logs (Apache/Nginx) showing requests to newly created pages with query parameters consistent with command injection (e.g., ?cmd=, ?c=).
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., sh, bash, curl, wget, python) following access to Dolibarr website pages.

The patch is available in Dolibarr ERP/CRM version 23.0.0, which addresses the inconsistent permission enforcement in the Website module. Organizations should upgrade immediately to version 23.0.0 or later (GitHub Advisory). As interim workarounds: restrict Website module access to only fully trusted users; remove HTML/JS editing permissions from any user who does not require them; audit all existing website pages created by restricted users for signs of PHP code injection; and implement web application firewall (WAF) rules to detect PHP code patterns in Dolibarr page creation requests.