Log in Start free

Vulnerability · Published Nov 5, 2026 · Assigned by GitHub_M

CVE-2026-33944Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

High 8.8

In plain English

A high-severity SQL injection in dolibarr from Dolibarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 56.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the  localtax1_value  and  localtax2_value  properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted  lt1  or  lt2  POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistdolibarr/dolibarr22.0.5GHSA-v5fq-cf5m-vwv7
Packagistdolibarr/dolibarr23.0.2GHSA-v5fq-cf5m-vwv7

Affected products (as reported)

VendorProductVersions
Dolibarr dolibarr < 22.0.5>= 23.0.0, < 23.0.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References