# CVE-2026-34036: Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php

Source: https://junglewise.ai/threats/cve-2026-34036-dolibarr-core-discloses-sensitive-data-via-authenticated-local  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31  
License: CC BY 4.0 with a link back

CVE-2026-34036 · Severity: medium · CVSS 6.5 · Published 2026-03-31

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as .env, .htaccess, configuration backups, or logs…). At time of publication, there are no publicly available patches.

Technologies: [Dolibarr Crm](https://junglewise.ai/threats/technologies/crm), [Dolibarr Erp\](https://junglewise.ai/threats/technologies/dolibarr-erp), [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr). Vendors: [Dolibarr](https://junglewise.ai/threats/vendors/dolibarr), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-34036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34036 being exploited in the wild.

**How severe is CVE-2026-34036?** Medium severity, with a CVSS score of 6.5, published 31 March 2026.

**Which products and versions are affected?** dolibarr/dolibarr (Packagist) < 23.0.0, ECOSYSTEM:introduced=0,last_affected=22.0.4.

**Is there a fix for CVE-2026-34036?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-34036?** Check whether you run Dolibarr Crm, Dolibarr Erp\ or dolibarr/dolibarr (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Dolibarr Crm
- Dolibarr Erp\
- dolibarr/dolibarr (Packagist) < 23.0.0, ECOSYSTEM:introduced=0,last_affected=22.0.4

## Identifiers

- CVE-2026-34036
- GHSA-2mfj-r695-5h9r

## Related threats

- [Dolibarr SQL injection in localtax parameters](https://junglewise.ai/threats/cve-2026-33944-dolibarr-has-sql-injection-in-societe-class-societe-class-php-via)
- [Dolibarr path traversal in email attachment handling](https://junglewise.ai/threats/cve-2026-81730-dolibarr-path-traversal-in-email-attachment-handling)
- [Dolibarr REST API authorization bypass in document deletion](https://junglewise.ai/threats/cve-2026-81729-dolibarr-rest-api-authorization-bypass-in-document-deletion)
- [Dolibarr SQL injection in CSV/XLSX import wizard](https://junglewise.ai/threats/cve-2026-81728-dolibarr-sql-injection-in-csv-xlsx-import-wizard)
- [Dolibarr authorization bypass in clonetasks private project check](https://junglewise.ai/threats/cve-2026-77923-dolibarr-authorization-bypass-in-clonetasks-private-project-check)