CVE-2026-34036: 
PHP vulnerability analysis and mitigation

CVE-2026-34036 is an authenticated Local File Inclusion (LFI) vulnerability in Dolibarr ERP/CRM affecting versions 22.0.4 and prior. The flaw resides in the core AJAX endpoint /core/ajax/selectobject.php, where manipulation of the objectdesc parameter combined with a fail-open logic flaw in the restrictedArea() access control function allows any authenticated user — regardless of privilege level — to read arbitrary non-PHP files on the server. It was disclosed on March 25, 2026 via GitHub Advisory GHSA-2mfj-r695-5h9r and published to NVD on March 31, 2026. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Dolibarr Advisory).

The root cause is a two-part design flaw classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP). First, selectobject.php parses the user-supplied objectdesc parameter into a $classpath variable and, when fetchObjectByElement() fails (e.g., by supplying a fake class like A:conf/.htaccess:0), falls back to calling dol_include_once($classpath) — including and dumping the target file's contents into the HTTP response buffer — before any authorization check is performed. Second, because the object lookup failed, the $features parameter passed to restrictedArea() is empty (''); inside security.lib.php, an empty $features value causes the access check block to be skipped entirely, leaving $readok = 1 and returning HTTP 200 OK instead of a 403 error. PHP files trigger a fatal error before their source is exposed, but all text-based files (.env, .htaccess, .json, .sql, logs, config backups) are fully disclosed in the response (GitHub Advisory, Dolibarr Commit).

Successful exploitation allows any authenticated Dolibarr user — including those with no specific module permissions — to exfiltrate arbitrary non-PHP files from the server filesystem. Sensitive targets include .env files (which may contain database credentials, API keys, and secret tokens), .htaccess and other infrastructure configuration files, SQL database dumps, application logs, and configuration backups. Disclosure of these files can enable credential harvesting, lateral movement to backend databases or connected services, and further escalation of attacks against the broader infrastructure (GitHub Advisory, Dolibarr Advisory).

A functional Python PoC exploit (CVE-2026-34036.py) is publicly available on GitHub, authored by the original reporter (cnf409), and automates authentication and file exfiltration against a live Dolibarr instance (PoC Repository). The exploit requires only valid credentials (any privilege level) and a network path to the target. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.026% (4th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Dolibarr ERP/CRM instances running version 22.0.4 or earlier using Shodan, Censys, or similar tools. Confirm the presence of the /core/ajax/selectobject.php endpoint.
2. Obtain credentials: Acquire any valid Dolibarr user account — no elevated privileges are required. This could be via phishing, credential stuffing, or a low-privilege account created during a trial/demo.
3. Authenticate: Log in to the Dolibarr instance via POST /index.php?mainmenu=home with the username and password, capturing the session cookie and CSRF token from the login page.
4. Craft the LFI request: Send a GET request to the vulnerable endpoint with a manipulated objectdesc parameter pointing to the target file:

   GET /core/ajax/selectobject.php?outjson=0&htmlname=x&objectdesc=A:conf/.htaccess:0

5. Retrieve file contents: The server includes the specified file and dumps its contents into the HTTP 200 response body before the PHP fatal error occurs. Parse the response to extract the file content, trimming any trailing PHP warning/error output.
6. Escalate: Use disclosed secrets (e.g., database passwords from .env, API keys) to pivot to backend systems, databases, or connected services (GitHub Advisory, PoC Repository).

• Network: Unusual GET requests to /core/ajax/selectobject.php with objectdesc parameter values containing file paths (e.g., A:conf/.htaccess:0, A:.env:0, A:conf/conf.php:0) rather than valid class descriptors; requests originating from unexpected IP addresses or user agents (e.g., dolibarr-lfi-poc/1.0-securitytest-for-dolibarr).
• Logs: Web server access logs showing repeated requests to /core/ajax/selectobject.php with varying objectdesc values; HTTP 200 responses to these requests followed by PHP fatal error output in application logs; login events from low-privilege accounts followed immediately by requests to the AJAX endpoint.
• File System: No direct file system artifacts are created by this read-only LFI; however, review for unexpected outbound connections or data exfiltration activity following exploitation.
• Process: No unusual child processes are expected from this read-only vulnerability, but monitor for subsequent exploitation attempts using credentials disclosed via the LFI (GitHub Advisory, PoC Repository).

A fix has been committed to the Dolibarr GitHub repository (commit 743c22e57c0b2a017d6b92bec865d71ce6177a6a), which applies dol_sanitizePathName() to the $classpath variable, restricts dol_include_once() to files matching *.class.php only, and changes the fallback restrictedArea() call to use 'unknownobject' instead of an empty string to enforce fail-secure access denial (Dolibarr Commit). Users should upgrade to a version of Dolibarr greater than 22.0.4 that includes this fix. As a temporary workaround, restrict network access to the /core/ajax/selectobject.php endpoint via firewall rules or web server configuration (e.g., require IP allowlisting). Additionally, audit server-side files for sensitive secrets and rotate any credentials that may have been exposed (GitHub Advisory).

The vulnerability was discovered and responsibly disclosed by Vincent KHAYAT (cnf409), who provided a detailed write-up and Python PoC as part of coordinated disclosure with the Dolibarr maintainers. The Dolibarr project lead (eldy) published the advisory on March 25, 2026, and the fix was committed shortly after. No significant broader media coverage or notable community debate has been identified beyond the GitHub advisory and associated PoC repository (GitHub Advisory, PoC Repository).