CVE-2026-34036

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated user with no specific privileges can read the contents of arbitrary non-PHP files on the server (such as .env, .htaccess, configuration backups, or logs…). At time of publication, there are no publicly available patches.

• CWE-98

• https://github.com/Dolibarr/dolibarr/commit/743c22e57c0b2a017d6b92bec865d71ce6177a6aPatch
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9rExploit, Mitigation, Vendor Advisory
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-2mfj-r695-5h9rExploit, Mitigation, Vendor Advisory

Published

Mar 31, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34030The Wertheim SafeController Software, AssemblyVersion 6.15.8…6.9
• CVE-2026-34031Unrestricted Upload of File with Dangerous Type vulnerabilit…6.5
• CVE-2026-34032Improper Null Termination, Out-of-bounds Read vulnerability …5.3
• CVE-2026-34033Improper Neutralization of Script-Related HTML Tags in a Web…5.4
• CVE-2026-34034Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34035Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34037Coolify is an open-source and self-hostable tool for managin…9.9
• CVE-2026-34038Coolify is an open-source and self-hostable tool for managin…9.9
• CVE-2026-3404A flaw has been found in thinkgem JeeSite up to 5.15.1. Impa…8.1
• CVE-2026-34040Moby is an open source container framework. Prior to version…7.8
• CVE-2026-34041act is a project which allows for local running of github ac…9.8
• CVE-2026-34042act is a project which allows for local running of github ac…8.2