CVE-2026-81728

Dolibarr ERP/CRM before 24.0.0 contains a SQL injection (CWE-89) in the CSV and XLSX import wizard, triggered through the 'updatekeys' GET parameter handled in htdocs/imports/import.php. The parameter is read with only the generic alphanohtml filter, which strips HTML but leaves SQL keywords, comments, parentheses, spaces and quotes intact, and import_insert() in htdocs/core/modules/import/import_csv.modules.php concatenates the submitted values into a SQL filter without validating them against the fixed list of legitimate column codes the interface offers. An authenticated user holding the import permission can inject a UNION SELECT to exfiltrate content from arbitrary database tables, and because the injected integer becomes the WHERE target of a subsequent UPDATE (and, for category link tables, the raw filter is spliced into that UPDATE directly), the attacker can also redirect which rows the import overwrites. All Dolibarr deployments prior to 24.0.0 are affected; the allow-list fix was added only in 24.0.0, and release 23.0.4 does not carry it. Exploitation has not been observed: there is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade to Dolibarr 24.0.0 or later, noting that 23.0.4 does not contain the fix. Until patched, limit the import permission to trusted users only, since exploitation requires an account with that privilege. Check import logs for unexpected or oversized 'updatekeys' values and audit recently imported rows for unexpected edits.