Dolibarr 16.0.3 RFI to RCE in dolibarr/dolibarr


Reported on

Feb 2nd 2023


The module "Websites" allows authenticated user to create new page template by fetching page from external URL. By using this feature, a malicious factor can get the malicious content (including PHP code) from his controlled web server, and then get the Remote Code Execution on the target webserver

Proof of Concept

Dolibarr RFI to RCE


This vulnerability could leads to Remote Code Execution against the target webserver

We are processing your report and will contact the dolibarr team within 24 hours. a year ago
We have contacted a member of the dolibarr team and are waiting to hear back a year ago
Laurent Destailleur validated this vulnerability a year ago
blakduk has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Laurent Destailleur marked this as fixed in 17.0 with commit 4a49ca a year ago
Laurent Destailleur has been awarded the fix bounty
a year ago


Need also commit c1ee02c51059644dfcb0072e6280374897d509a7

This vulnerability has now been published a month ago
to join this conversation