Detections
Analytics

SCA: security update for dolibarr/dolibarr (GHSA-v5fq-cf5m-vwv7)

high Tenable Cloud Security Plugin ID 477571

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Dolibarr is an open-source enterprise resource planning and customer relationship management application.
 Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update
 functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL
 UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with
 Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive
 database information, including password hashes, API keys, and business data, or modify third-party
 records. This issue is fixed in versions 22.0.5 and 23.0.2. (CVE-2026-33944)

Solution

Update the dolibarr/dolibarr library and its related packages to version 22.0.5 or later.

See Also

https://github.com/advisories/GHSA-v5fq-cf5m-vwv7

Plugin Details

Severity: High

ID: 477571

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 10/27/2026

Updated: 11/6/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-33944

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/27/2026

Reference Information

CVE: CVE-2026-33944

cwe: CWE-89