Dolibarr Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-81728 - Vulnerability Database

Dolibarr

Dolibarr Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne - CVE-2026-81728

Low

Reference: CVE-2026-81728

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-81728

Title: Dolibarr Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulne

Overview:

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST(updatekeys array) in htdocs/imports/import.php which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords comment markers parentheses spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv.modules.php then iterates the submitted values and builds a filter with where key. .datakey havin