Dolibarr versions up to 22.0.4 contain a local file inclusion flaw in the AJAX endpoint core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail‑open condition in the restrictedArea() access‑control function, an authenticated user can read any non‑PHP file on the server, such as .env, .htaccess, configuration backups, or logs. This vulnerability falls under CWE‑98 and allows exposure of secrets, credentials, and configuration details, potentially compromising confidentiality of the entire system.

The affected product is Dolibarr ERP/CRM, specifically versions 22.0.4 and earlier. No special privileges are required beyond standard authentication; any logged‑in user can trigger the inclusion. At the time of this publication, no official patch has been released by the vendor.

The CVSS score of 6.5 places the vulnerability in the medium severity range, while the EPSS score of less than 1 % indicates a low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector is local but authenticated; a user must be able to log into the application and craft a request to core/ajax/selectobject.php with a carefully chosen objectdesc value. The exploit is straightforward once access is granted, but requires no additional privilege escalation.