CVE-2026-34036 Details
Description
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as .env, .htaccess, configuration backups, or logs…). At time of publication, there are no publicly available patches.
A Local File Inclusion (LFI) vulnerability has been identified in Dolibarr versions through 22.0.4. The issue resides in the core AJAX endpoint selectobject.php, where an authenticated user can manipulate the objectdesc parameter to include arbitrary non-PHP files from the server. This vulnerability exploits a fail-open logic flaw in the access control function restrictedArea(), allowing sensitive files such as .env, .htaccess, configuration backups, or logs to be read. The vulnerability arises because dynamic file inclusion occurs before access control checks, creating a window for exploitation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/Dolibarr/dolibarr/commit/743c22e57c0b2a017d6b92bec865d71ce6177a6a | [email protected] | Patch |
| https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dolibarr dolibarr erp/crm | <= 22.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | New CVE Received | [email protected] |