Security readout for executives and security teams
Plain-English summary
CVE-2026-31018 affects Dolibarr ERP & CRM 22.0.4 and earlier. A logged-in user who should only edit website HTML or JavaScript may be able to add PHP code during page creation. That can turn a limited content-editing account into a serious system compromise risk.
Executive priority
Prioritize remediation for internet-facing or broadly used Dolibarr systems. The flaw can let a limited authenticated editor affect confidentiality, integrity, and availability. If the Website module is unused, disabling or tightly restricting it can reduce immediate business risk while vendor guidance is reviewed.
Technical view
The issue is inconsistent PHP code detection and editing-permission enforcement in Dolibarr’s Website module. Unprotected input parameters during website page creation may accept PHP from an authenticated low-privilege user. The CVSS 3.1 score is 8.8, reflecting network access, low complexity, low privileges, and high confidentiality, integrity, and availability impact.
Likely exposure
Organizations using Dolibarr ERP & CRM version 22.0.4 or earlier with the Website module enabled are potentially exposed. Risk is higher where non-admin users can create or edit website pages.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires authentication but no user interaction, according to the CVSS vector. Public reference material exists, so defenders should treat this as actionable exposure.
Researcher notes
Evidence identifies Dolibarr ERP & CRM <= 22.0.4 and the Website module. The bundled affected CPE data is incomplete, and no official fixed version is provided in the supplied sources. Avoid assuming exploitation in the wild without KEV or vendor confirmation.
Mitigation direction
- Identify Dolibarr deployments and versions, especially 22.0.4 and earlier.
- Check Dolibarr vendor guidance for fixed versions or official mitigations.
- Limit Website module page creation and editing to trusted administrators.
- Review and reduce accounts granted HTML or JavaScript website editing rights.
- Monitor website content for unexpected PHP code or unauthorized page changes.
Validation and detection
- Confirm whether Dolibarr ERP & CRM is deployed.
- Record the installed Dolibarr version and compare with 22.0.4 or earlier.
- Determine whether the Website module is enabled.
- List users allowed to create or edit website pages.
- Review recent website page changes for unexpected server-side code.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-31018 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H2.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31018/README.mdCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.