CVE-2026-58376: Dolibarr SQL injection in sqlfilters API parameter

CVE-2026-58376 · Severity: high · CVSS 7.6 · Published 2026-06-30

Dolibarr, an open-source ERP and CRM software suite, contains a security vulnerability in its application programming interface (API). An authorized user with low-level access can bypass security filters to run unauthorized database commands. This allows an attacker to steal sensitive information from the entire database, including user passwords and secret API keys, potentially leading to a full system takeover.

Technologies: Dolibarr. Vendors: Dolibarr.

Quick answers

Is CVE-2026-58376 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58376 being exploited in the wild.
How severe is CVE-2026-58376?
High severity, with a CVSS score of 7.6, published 30 June 2026.
Which products and versions are affected?
Dolibarr through 23.0.3.
Is there a fix for CVE-2026-58376?
A patch was published on 2026-06-13: Fix merged in commit 14db36e Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58376 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-58376?
Check whether you run Dolibarr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in Dolibarr through version 23.0.3 due to the use of legacy filtering logic in the 'setup dictionary' and 'multicurrencies' REST API endpoints. The affected components, api_setup.class.php and api_multicurrencies.class.php, utilize a legacy validation method that only checks for balanced parentheses and fails to sanitize text outside of matched triplets. An authenticated attacker can provide a malicious 'sqlfilters' query parameter containing a UNION SELECT statement, which is concatenated directly into the SQL WHERE clause. This enables the exfiltration of sensitive data such as password hashes and API keys. The issue is resolved by migrating these endpoints to the hardened forgeSQLFromUniversalSearchCriteria() function, as seen in commit 14db36e.

Affected products

  • Dolibarr Dolibarr through 23.0.3

Timeline

  • 2026-06-13: disclosed: Issue reported on GitHub
  • 2026-06-13: patched: Fix merged in commit 14db36e
  • 2026-06-30: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.