SQL Injection in Dolibarr's CSV and XLSX Import Wizard

CVE-2026-81728

What is CVE-2026-81728?

Dolibarr is susceptible to a SQL injection through its CSV and XLSX import wizard, allowing attackers with import permissions to execute arbitrary SQL commands. The vulnerability arises when imported keys are processed using a minimal filtering approach, exposing the database to exploitation. Specifically, the import functionality accepts unsafe input without adequate validation, permitting an attacker to construct a malicious SELECT statement that can read sensitive data and manipulate database entries. A patch has been introduced in version 24.0.0, which implements an allow-list for input validation, addressing the security weakness present in earlier versions.

References