CVE-2026-110874
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in…
- Risk score
- 58/100
- CVSS
- 6.6 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 15 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that tri…
- Affected
- See advisory
- Fix
- Upgrade the product to 23.0.4 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.6 medium
- On your watchlist: php
References
Original description
Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.
Last activity 15 Oct 2026. Patch Forecast updates every hour.