Executive brief
Dolibarr is an open-source business management software used by organizations to handle sales, accounting, and customer relationships. A reflected cross-site scripting vulnerability in the extra fields administration interface allows an attacker to trick an authenticated administrator into clicking a malicious link, which can execute arbitrary JavaScript code in the administrator's browser session and lead to the creation of unauthorized administrator accounts.
Technical details
This is a reflected XSS vulnerability in the extra fields administration template where the "type" request parameter is echoed into an inline script block without proper JavaScript-context encoding, and the application does not emit a Content-Security-Policy header to mitigate XSS attacks. An unauthenticated attacker can craft a URL containing malicious JavaScript that will execute when an authenticated administrator visits the link. The vulnerability allows an attacker to perform actions in the administrator's context, including account creation. The fix involves properly escaping JavaScript strings in the vulnerable template file.
Affected products
- Dolibarr Dolibarr before 24.0.0
Timeline
- 2026-08-24: disclosed