CVE-2026-81728 Dolibarr CVE debrief

Who should care

Dolibarr Erp/crm users, administrators, and security teams should be aware of this vulnerability and take necessary actions to mitigate it. This includes applying the patch from version 24.0.0 or later, restricting import permissions to trusted users, and monitoring import logs for suspicious activity.

Technical summary

The SQL injection vulnerability in Dolibarr Erp/crm's CSV and XLSX import wizard allows an attacker with import permissions to inject malicious SQL code. The vulnerability is caused by the lack of proper sanitization of user-input data in the import.php and import_csv.modules.php files. An attacker can exploit this vulnerability to exfiltrate arbitrary table content and potentially overwrite rows in certain tables.

Defensive priority

High

Recommended defensive actions

• Apply the patch from version 24.0.0 or later
• Restrict import permissions to trusted users
• Monitor import logs for suspicious activity
• Use prepared statements with parameterized queries
• Validate and sanitize all user-input data

Evidence notes

The vulnerability is caused by the use of the GETPOST function to read update keys from user input, which are then used to construct SQL queries without proper sanitization. The import_insert function in import_csv.modules.php iterates over the submitted values and builds a filter string using $where[] = $key.' = '.$data[$key]. This string is then executed through $this->db->query(). An attacker can inject malicious SQL code by submitting specially crafted values.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.