---
id: CVE-2026-34036
title: >-
  Dolibarr is an enterprise resource planning (ERP) and customer relationship
  management (CRM) software package
summary: >-
  Dolibarr is an enterprise resource planning (ERP) and customer relationship
  management (CRM) software package. In versions 22.0.4 and prior, there is a
  Local File Inclusion (LFI) vulnerability in the core AJAX endpoint
  /core/ajax/selecto…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-98
vendor: dolibarr
product: dolibarr_erp/crm
affected:
  - dolibarr_erp/crm <= 22.0.4
published: '2026-03-31'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T08:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34036'
references:
  - url: >-
      https://github.com/Dolibarr/dolibarr/commit/743c22e57c0b2a017d6b92bec865d71ce6177a6a
    label: security-advisories@github.com
  - url: >-
      https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r
    label: security-advisories@github.com
  - url: >-
      https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9r
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - exploit-available
epss: 0.01468
epssPercentile: 0.72883
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/cnf409/CVE-2026-34036'
  nuclei:
    - CVE-2026-34036
  checkedAt: '2026-10-07T08:20:38.253Z'
exploitAvailable: true
ingestedAt: '2026-10-07T08:20:03.910Z'
---

## Overview

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as .env, .htaccess, configuration backups, or logs…). At time of publication, there are no publicly available patches.

## Affected

- `dolibarr_erp/crm <= 22.0.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.