Loading vulnerability…
CVE-2026-34036 is an authenticated local file inclusion vulnerability affecting Dolibarr ERP/CRM versions 22.0.4 and earlier. The flaw is present in the core AJAX endpoint selectobject.php, where manipulation of the objectdesc parameter can cause the application to include or read unintended local files. The issue is compounded by a fail-open logic flaw in the restrictedArea() access-control function, allowing an authenticated user without specific privileges to bypass intended restrictions and access arbitrary non-PHP files on the server. Exposed files may include environment files, web server configuration files, backup configuration files, and application logs.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a minimal proof-of-concept for CVE-2026-34036 affecting Dolibarr. It contains two files: a single Python exploit script (CVE-2026-34036.py) and a README describing the vulnerability and usage. The script uses the requests library and is structured around three functions: login(), which fetches the base page, extracts a CSRF token from the login form, submits credentials to /index.php?mainmenu=home, and verifies authentication by checking for /user/logout.php in the returned HTML; read_file(), which sends an authenticated GET request to /core/ajax/selectobject.php with parameters outjson=0, htmlname=x, and a crafted objectdesc value of the form A:<path>:0 to trigger the file-read behavior; and main(), which parses command-line arguments for target URL, username, password, and file path, then prints the retrieved file contents. The exploit’s primary capability is authenticated arbitrary local file read, not code execution. It does not drop a shell, modify server state, or include persistence features. The README confirms the vulnerability is an authenticated LFI in Dolibarr’s selectobject.php endpoint and documents an example target path of conf/.htaccess. Overall, this is a straightforward, single-purpose web exploit PoC intended to demonstrate and validate arbitrary file disclosure on a vulnerable Dolibarr deployment.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.