Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Dolibarr bug bounty programs

dolibarr.org Updated

Dolibarr runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Dolibarr runs.

  • Dolibarr

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 6 excluded.

  • https://www.dolibarr.org

    Web

  • Email sending and the mass-mailing module, including any template a user supplies

    Products and areas

  • External authentication connectors, including LDAP and any single sign-on module in the core tree

    Products and areas

  • List views, search filters and the SQL those parameters are built into

    Products and areas

  • The core modules a real deployment turns on: third parties and contacts, proposals, orders, invoices, accounting, stock, projects, HR and expense reports

    Products and areas

  • The document generation layer, which renders ODT and PDF output from templates that an administrator can edit

    Products and areas

  • The electronic content management module and every upload and download route that touches the documents directory

    Products and areas

  • The installer and the upgrade path, plus the module activation mechanism that enables new code on a running instance

    Products and areas

  • The multicompany arrangement, where one installation serves several legal entities out of one database

    Products and areas

  • The permission system, which grants rights per module per user and is the single control standing between a limited employee and the company's finances

    Products and areas

  • The policy takes private reports on any supported version, defining support as the five most recent major releases, and states eligibility rules rather than a component carve-out. Everything shipped in the core tree inside that window is in scope

    Products and areas

  • The public-facing interfaces Dolibarr exposes to unauthenticated visitors, including public ticket submission, online payment pages and online signature links

    Products and areas

  • The REST API and the API key mechanism scripted consumers authenticate with

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • A permission grant an administrator made deliberately, since the module permission matrix is a configuration decision

  • Hosting and server configuration, including a web root that exposes the documents directory

  • Modules from Dolistore and other external module authors, which ship outside the core repository

  • Releases older than the five most recent majors, the support window the policy defines

  • Scanner output submitted without a working reproduction against a supported release

  • Upstream PHP library issues, unless Dolibarr's own use of the library is what makes the defect reachable

Recent changes

Reward and scope changes across every Dolibarr program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Dolibarr products, from the NVD.

Search NVD
  • CVE-2026-81728 High

    Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers, parentheses, spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv.modules.php

  • CVE-2026-81729 High

    Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated

  • CVE-2026-81730 High

    Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollecto

  • CVE-2026-77923 Medium

    Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks i

  • CVE-2018-25357 Critical

    Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.

  • CVE-2025-67486 High

    Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators

  • CVE-2026-31019 High

    In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.

  • CVE-2026-31018 High

    In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation.

About this page

This page gathers every public program listed under dolibarr.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.