PHP Object Injection Vulnerability in Dolibarr by Dolibarr Association

CVE-2026-110874

What is CVE-2026-110874?

Dolibarr prior to version 23.0.4 contains a PHP object injection flaw in the jsonOrUnserialize() function located in functions.lib.php. This vulnerability arises because unserialize() can be called without class restrictions if json_decode() fails. An attacker with permissions to write stored extrafields, export configurations, or manipulate log entries can exploit this to plant serialized objects that may trigger gadget chains, leading to unauthorized code execution or file manipulation.

References