CVE-2026-58376

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58376
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58376.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58376
Published
2026-06-30T15:59:10.565Z
Modified
2026-08-07T11:48:49.757490115Z
Severity
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints
Details

Dolibarr through 23.0.3, fixed in commit 14db36e, contains a sql injection vulnerability that allows authenticated API users to exfiltrate arbitrary database contents by supplying malicious values to the sqlfilters query parameter in the setup dictionary and multicurrencies REST API endpoints. The affected endpoints in apisetup.class.php and apimulticurrencies.class.php validate sqlfilters only for balanced parentheses and rewrite matched triplets, allowing text placed outside the expected shape such as an appended UNION SELECT to be concatenated into the SQL WHERE clause unmodified, enabling retrieval of sensitive data including password hashes and API keys.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58376.json",
    "cwe_ids": [
        "CWE-89"
    ]
}
References

Affected packages

Git / github.com/dolibarr/dolibarr

Affected ranges

Type
GIT
Repo
https://github.com/dolibarr/dolibarr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
57d0be7dc97140d7d47e826875ba9256ec3b6357
Fixed
14db36e8486ef725b0d493d97abb2950a54358d3
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "23.0.3"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

14.*
14.0.0
14.0.1
23.*
23.0.0
23.0.1
23.0.2
23.0.3
3.*
3.3.beta1_20121221
3.4.beta1_20130429
3.4.beta1_20130502
3.5.beta1_20131106
3.5.beta1_20131120
3.6.0
3.6.0-alpha
3.6.0-beta
3.6.1
3.6.2
3.6.beta1_20140514
3.7.0
3.7.1
3.8.0-beta
4.*
4.0.0-rc
5.*
5.0.0-beta
6.*
6.0.0-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58376.json"