CVE-2026-81728 - Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
Brief
CVE ID : CVE-2026-81728
Published : Aug. 27, 2026, 8:18 p. m.
- 55 minutes ago
Description : Dolibarr before 24.
- 0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import. php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers, parentheses, spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv. modules.
php then iterates the submitted values and builds a filter with $where[] = $key.' = '. $data[$key], having first applied preg_replace('/^. *\. /i', '', $key), an alias strip that does nothing to a value containing no dot. The assembled string is executed through $this-db-query().