HIGH 7.5 NVD
CVE-2026-110874
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restri
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
References
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/commit/17658fcaefdaabe13685e566e5f12d5fbd4f4a5c
- https://github.com/Dolibarr/dolibarr/pull/38530
- https://www.vulncheck.com/advisories/dolibarr-before-23.0.4-php-object-injection-via-jsono
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-15 via NVD.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.