{"cve":"CVE-2026-23500","nvd":{"published":"2026-04-17T21:16:31.890","modified":"2026-06-17T10:21:42.067","status":"Analyzed","description":"Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using command separators, achieving remote code execution as the web server user when any ODT template is generated. This issue has been fixed in version 23.0.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","score":9.4},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","score":9.1},"cwes":["CWE-78"],"references":["https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0","https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-w5j3-8fcr-h87w"],"products":["dolibarr:dolibarr_erp\\/crm"],"source":"nvd","synced_at":"2026-10-19T22:30:49.762551342+00:00"},"epss":{"cve":"CVE-2026-23500","score":0.00922,"percentile":0.60334,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}