Dolibarr selectobject.php Authenticated Local File Inclusion (CVE-2026-34036)

Metadata

Affected Target

Summary

Dolibarr’s core/ajax/selectobject.php endpoint, used to power object-picker autocomplete widgets in the UI, accepts an objectdesc parameter that is used to build a path to a local file. An authenticated user can craft an objectdesc value (in the form A:<path>:0) that causes the endpoint to read and return the contents of an arbitrary local file on the server instead of the intended object description file. The included PoC logs into a target Dolibarr instance with valid credentials, issues the crafted request against selectobject.php, and prints the disclosed file contents after trimming PHP warning/error noise from the response.

Vulnerability Details

Root Cause

The objectdesc parameter passed to core/ajax/selectobject.php is used to construct a filesystem path without adequate validation, allowing an authenticated user to specify arbitrary paths relative to the Dolibarr web root.

Attack Vector

1. Authenticate to the target Dolibarr instance with any valid low-privilege account.
2. Send a GET request to core/ajax/selectobject.php with objectdesc=A:<path>:0 where <path> is the file to read (e.g. conf/.htaccess).
3. The endpoint reads and returns the contents of the specified file in the HTTP response.
4. Strip PHP warning/fatal-error noise from the response to recover the clean file contents.

Impact

Disclosure of arbitrary local files readable by the web server process (e.g. configuration files, credentials, source code), which can lead to further compromise such as database credential theft.

Environment / Lab Setup

Target:   Dolibarr instance with core/ajax/selectobject.php reachable, valid user account
Attacker: Python 3 + requests library

Proof of Concept

PoC Script

See CVE-2026-34036.py in this folder.

1
2
3
4
5

python3 CVE-2026-34036.py \
  --url http://127.0.0.1:8080 \
  --username admin \
  --password admin \
  --file conf/.htaccess

The script logs into Dolibarr using the supplied credentials, requests core/ajax/selectobject.php with a crafted objectdesc parameter pointing at the target file, and prints the disclosed file contents to stdout.

Detection & Indicators of Compromise

Signs of compromise:

• Access log entries for core/ajax/selectobject.php with objectdesc values referencing configuration files or paths outside the expected object-picker usage
• Repeated authenticated requests to the same AJAX endpoint from a single session enumerating different file paths

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/cnf409/CVE-2026-34036 on 2026-07-05.