Loading vulnerability…
OS Command Injection in Dolibarr ODT-to-PDF Conversion
CVE-2026-23500 is an OS command injection vulnerability in Dolibarr ERP/CRM affecting versions prior to 23.0.0. The flaw is in the ODT-to-PDF conversion path in odf.php, where the MAIN_ODT_AS_PDF configuration constant is concatenated directly into a shell command that is executed via exec() without sanitization. An authenticated administrator can supply shell metacharacters or command separators through this configuration value, causing arbitrary operating system commands to be executed when any ODT template is generated. Commands run in the security context of the web server user.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary command execution on the underlying host as the web server user. This can enable full compromise of the Dolibarr application context, access to application data and credentials available to the web process, modification of data, deployment of persistence mechanisms accessible to that user, and potential follow-on lateral movement or privilege escalation depending on host configuration.
If you can’t patch tonight, do this now.
Until upgrading, restrict administrator access to trusted users only, because exploitation requires authenticated administrative privileges. Disable or avoid the ODT-to-PDF conversion feature if operationally feasible. Audit and tightly control the MAIN_ODT_AS_PDF configuration value for unexpected shell metacharacters or command separators, and monitor template-generation activity and web server child processes for anomalous command execution.
Patch, then assume compromise.
Upgrade Dolibarr to version 23.0.0 or later, where this issue is fixed. Review the implementation of the ODT-to-PDF conversion feature and ensure user- or admin-controlled configuration values are not concatenated into shell commands. If local modifications exist, replace shell invocation patterns with safe APIs or strict argument handling and input validation.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.