Dolibarr versions earlier than 23.0.4 allow PHP object injection through the jsonOrUnserialize() function in functions.lib.php. This function calls unserialize() without restricting the classes that can be instantiated when json_decode() fails, creating a weakness classified as CWE-502. An attacker can supply a serialized payload that, when processed, triggers gadget chains capable of executing arbitrary code or manipulating files on the server, thus compromising confidentiality, integrity, and availability of the system.

The affected product is Dolibarr ERP/CRM before version 23.0.4. Users running these earlier releases are exposed to this injection flaw and should assess their current installation.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1 % suggests the probability of exploitation is currently low, and the vulnerability is not listed in CISA’s KEV catalog. According to the description, exploitation requires the attacker to have the ability to write stored extrafields, export configuration data, or blocked log entries; therefore the vector is most likely an authenticated or privileged user. When such data is injected, the vulnerable unserialize call can instantiate arbitrary objects, enabling code execution or file manipulation on the server.