CVE-2026-110874CWE-502insecure-deserialization

CVE-2026-110874

Medium · published October 15, 2026

CVSS v3.1
6.6
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.5 · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00510 · 42.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-10-15T23:17Z
References (4)
https://github.com/Dolibarr/dolibarr · [email protected]https://github.com/Dolibarr/dolibarr/commit/17658fcaefdaabe13685e566e5f12d5fbd4f4a5c · [email protected]https://github.com/Dolibarr/dolibarr/pull/38530 · [email protected]https://www.vulncheck.com/advisories/dolibarr-before-23.0.4-php-object-injection-via-jsonorunserialize · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 15 OCT 18:57Z
    Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
    cvelistv5
  • 15 OCT 18:57Z
    Dolibarr before 23.0.4 PHP Object Injection via jsonOrUnserialize()
    cvelistv5