CVE-2026-110874

Dolibarr versions prior to 23.0.4 are vulnerable to a PHP object injection flaw within the jsonOrUnserialize() function in functions.lib.php. The vulnerability occurs because the application calls unserialize() without class restrictions when json_decode() fails. If an attacker can provide input ...