CVE-2026-34036

Dolibarr 22.0.4 and earlier contains a Local File Inclusion (LFI) in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic in restrictedArea(), an authenticated user with no special privileges can read arbitrary non-PHP files...

CVE-2026-34036

Dolibarr is an enterprise resource planning ERP and customer relationship management CRM software package. In versions 22.0.4 and prior, there is a Local File Inclusion LFI vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting...