What is CVE-2026-110874?

CVE-2026-110874 is a medium-severity vulnerability in Dolibarr, classified under Deserialization of Untrusted Data. CVSS score: 6.6/10. Published 2026-10-15.

How severe is CVE-2026-110874?

Medium severity. CVSS v3 base score is 6.6 out of 10.

Deserialization in Dolibarr

CVE-2026-110874

Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions when json_decode() fails. Attackers able to write stored extrafields, export configurations or blocked log entries can plant serialized objects that trigger gadget chains for code execution or file manipulation.

Vulnerability class: Insecure Deserialization

Published 2026-10-15 · last modified 2026-10-15.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Dolibarr

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

github.com/Dolibarr/dolibarr/pull/38530 (issue-tracking, patch)
github.com/Dolibarr/dolibarr/commit/17658fcaefdaabe13685e566e5f12d5fbd4f4a5c (patch)
github.com/Dolibarr/dolibarr (product)
www.vulncheck.com/advisories/dolibarr-before-23.0.4-php-object-injection-via-js… (third-party-advisory)

Frequently asked questions

What is CVE-2026-110874?: CVE-2026-110874 is a medium-severity vulnerability in Dolibarr, classified under Deserialization of Untrusted Data. CVSS score: 6.6/10. Published 2026-10-15.
How severe is CVE-2026-110874?: Medium severity. CVSS v3 base score is 6.6 out of 10.