What is GHSA-676v-wh57-p375?

GHSA-676v-wh57-p375 is a security advisory published by GitHub Security Advisories with High severity. Dolibarr Allows Code Injection through its Website Module

Which CVE IDs does GHSA-676v-wh57-p375 cover?

GHSA-676v-wh57-p375 covers the following CVE IDs: CVE-2026-31018. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-676v-wh57-p375?

GHSA-676v-wh57-p375 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-676v-wh57-p375?

GHSA-676v-wh57-p375 affects 1 product, including: composer/dolibarr/dolibarr:\u003c= 15.0.3.

GHSA-676v-wh57-p375HighCVSS 8.8

Dolibarr Allows Code Injection through its Website Module

Vendor

GitHub Security Advisories

Published

April 21, 2026

Last Modified

April 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-31018 →

📋 Description

In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

A patch is available at https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0.

🎯 Affected products1

composer/dolibarr/dolibarr:<= 15.0.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-31018
https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.md
http://dolibarr.com
https://github.com/Dolibarr/dolibarr/commit/ba28d16da4cc0c221f49a878fecc8425501ceb96
https://github.com/Dolibarr/dolibarr/releases/tag/23.0.0
https://github.com/advisories/GHSA-676v-wh57-p375