- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://www.dolibarr.org
Products and areas 12
- Email sending and the mass-mailing module, including any template a user supplies
- External authentication connectors, including LDAP and any single sign-on module in the core tree
- List views, search filters and the SQL those parameters are built into
- The core modules a real deployment turns on: third parties and contacts, proposals, orders, invoices, accounting, stock, projects, HR and expense reports
- The document generation layer, which renders ODT and PDF output from templates that an administrator can edit
- The electronic content management module and every upload and download route that touches the documents directory
- The installer and the upgrade path, plus the module activation mechanism that enables new code on a running instance
- The multicompany arrangement, where one installation serves several legal entities out of one database
- The permission system, which grants rights per module per user and is the single control standing between a limited employee and the company's finances
- The policy takes private reports on any supported version, defining support as the five most recent major releases, and states eligibility rules rather than a component carve-out. Everything shipped in the core tree inside that window is in scope
- The public-facing interfaces Dolibarr exposes to unauthenticated visitors, including public ticket submission, online payment pages and online signature links
- The REST API and the API key mechanism scripted consumers authenticate with
Out of scope (6)
- A permission grant an administrator made deliberately, since the module permission matrix is a configuration decision
- Hosting and server configuration, including a web root that exposes the documents directory
- Modules from Dolistore and other external module authors, which ship outside the core repository
- Releases older than the five most recent majors, the support window the policy defines
- Scanner output submitted without a working reproduction against a supported release
- Upstream PHP library issues, unless Dolibarr's own use of the library is what makes the defect reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Prefer a GitHub private security advisory on Dolibarr/dolibarr, the channel the policy recommends first.
-
The policy defines support as the five most recent major versions. A finding against anything older falls outside it
-
The policy asks security testers to append -securitytest-for-dolibarr to their User-Agent string
-
Say which modules were enabled.
-
Hold the detail until the fixed releases are out across that window
Not accepted
-
A permission grant an administrator made deliberately
-
Upstream PHP library issues, unless Dolibarr's own use of the library is what makes the defect reachable
-
Hosting and server configuration, including a web root that exposes the documents directory
-
Scanner output submitted without a working reproduction against a supported release
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-81728 | Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leaves SQL keywords, comment markers, parentheses, spaces and quotes intact. import_insert() in htdocs/core/modules/import/import_csv.modules.php | High 8.6 | 27 Aug 2026 |
| CVE-2026-81729 | Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs/api/class/api_documents.class.php calls dol_check_secure_access_document() with the mode argument 'read' when handling DELETE /api/index.php/documents, while the sibling builddoc() path passes 'write', the correct mode for an operation that modifies stored data. An authenticated | High 7.1 | 27 Aug 2026 |
| CVE-2026-81730 | Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it to file_put_contents(), and the private saveAttachment() in htdocs/emailcollector/class/emailcollecto | High 8.8 | 27 Aug 2026 |
| CVE-2026-77923 | Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project membership check within the clonetasks mass action handler in htdocs/core/actions_massactions.inc.php. Authenticated users with project creation permission but without access to a target private project can exploit the flawed !in_array() check to clone tasks i | Medium 5.3 | 24 Aug 2026 |
| CVE-2018-25357 | Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter. | Critical 9.3 | 23 May 2026 |
| CVE-2025-67486 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionality. User-controlled input from the "computed value" field is passed to PHP's `eval()` function without adequate sanitization, allowing authenticated administrators | High 8.6 | 8 May 2026 |
| CVE-2026-31019 | In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server. | High 8.8 | 21 Apr 2026 |
| CVE-2026-31018 | In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page creation. | High 8.8 | 21 Apr 2026 |
| CVE-2026-23500 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command passed to exec() without sanitization. An authenticated administrator can inject arbitrary OS commands via this constant using c | Critical 9.4 | 17 Apr 2026 |
| CVE-2019-25710 | Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerability in the rowid parameter of the admin dict.php endpoint that allows attackers to execute arbitrary SQL queries. Attackers can inject malicious SQL code through the rowid POST parameter to extract sensitive database information using error-based SQL injection techniques. | High 8.8 | 12 Apr 2026 |
| CVE-2026-22666 | Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callabl | High 8.6 | 7 Apr 2026 |
| CVE-2026-34036 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior, there is a Local File Inclusion (LFI) vulnerability in the core AJAX endpoint /core/ajax/selectobject.php. By manipulating the objectdesc parameter and exploiting a fail-open logic flaw in the core access control function restrictedArea(), an authenticated us | Medium 6.5 | 31 Mar 2026 |
| CVE-2019-25450 | Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, an | High 7.1 | 22 Feb 2026 |
| CVE-2019-25452 | Dolibarr ERP/CRM 10.0.1 contains an SQL injection vulnerability in the elemid POST parameter of the viewcat.php endpoint that allows unauthenticated attackers to execute arbitrary SQL queries. Attackers can submit crafted POST requests with malicious SQL payloads in the elemid parameter to extract sensitive database information using error-based or time-based blind SQL injection techniques. | High 8.8 | 22 Feb 2026 |
| CVE-2021-47779 | Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation. | High 8.4 | 16 Jan 2026 |
| CVE-2025-56588 | Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter. | High 8.8 | 1 Oct 2025 |
| CVE-2024-55227 | A cross-site scripting (XSS) vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter. | Critical 9.0 | 27 Jan 2025 |
| CVE-2024-55228 | A cross-site scripting (XSS) vulnerability in the Product module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter. | Critical 9.0 | 27 Jan 2025 |
| CVE-2021-3991 | An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions. | Medium 4.3 | 15 Nov 2024 |
| CVE-2024-37821 | An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file. | High 8.8 | 18 Jun 2024 |
| CVE-2024-5314 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php. | Critical 9.1 | 24 May 2024 |
| CVE-2024-5315 | Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php. | Critical 9.1 | 24 May 2024 |
| CVE-2024-31503 | Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookies and CSRF protection tokens via user interaction with a crafted web page, leading to account takeover. | High 7.5 | 17 Apr 2024 |
| CVE-2024-29477 | Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted input. | High 8.8 | 3 Apr 2024 |
| CVE-2024-23817 | Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Version 18.0.4 has a HTML Injection vulnerability in the Home page of the Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML | High 7.1 | 25 Jan 2024 |
| CVE-2023-4198 | Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data | Medium 6.5 | 1 Nov 2023 |
| CVE-2023-4197 | Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code. | High 7.5 | 1 Nov 2023 |
| CVE-2023-5842 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5. | Medium 4.8 | 30 Oct 2023 |
| CVE-2023-5323 | Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0. | Medium 6.1 | 1 Oct 2023 |
| CVE-2023-38888 | Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject. | Critical 9.6 | 20 Sep 2023 |
| CVE-2023-38886 | An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. | High 7.2 | 20 Sep 2023 |
| CVE-2023-38887 | File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions. | High 8.8 | 20 Sep 2023 |
| CVE-2023-33568 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. | High 7.5 | 13 Jun 2023 |
| CVE-2023-30253 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. | High 8.8 | 29 May 2023 |
| CVE-2022-4093 | SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-profile data breaches in recent years have been the result of SQL injection attacks, leading to reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a lo | Critical 9.8 | 21 Nov 2022 |
| CVE-2022-43138 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. | Critical 9.8 | 17 Nov 2022 |
| CVE-2022-40871 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval. | Critical 9.8 | 12 Oct 2022 |
| CVE-2022-2060 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. | Medium 5.4 | 13 Jun 2022 |
| CVE-2022-30875 | Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. | Medium 6.1 | 8 Jun 2022 |
| CVE-2021-37517 | An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service. | High 7.5 | 31 Mar 2022 |
| CVE-2021-36625 | An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement. | High 8.8 | 31 Mar 2022 |
| CVE-2022-0819 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. | High 8.8 | 2 Mar 2022 |
| CVE-2022-0746 | Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0. | Medium 4.3 | 25 Feb 2022 |
| CVE-2022-0731 | Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. | Medium 6.5 | 23 Feb 2022 |
| CVE-2022-0414 | Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. | Medium 4.3 | 31 Jan 2022 |
| CVE-2022-0224 | dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command | Critical 9.8 | 14 Jan 2022 |
| CVE-2022-0174 | Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr. | Medium 4.3 | 10 Jan 2022 |
| CVE-2022-22293 | admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. | Medium 5.4 | 2 Jan 2022 |
| CVE-2021-42220 | A Cross Site Scripting (XSS) vulnerability exists in Dolibarr before 14.0.3 via the ticket creation flow. Exploitation requires that an admin copies the payload into a box. | Medium 5.4 | 15 Dec 2021 |
| CVE-2021-33618 | Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature. | Medium 6.1 | 10 Nov 2021 |
| CVE-2021-33816 | The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked. | Critical 9.8 | 10 Nov 2021 |
| CVE-2021-25956 | In “Dolibarr” application, v3.3.beta1_20121221 to v13.0.2 have “Modify” access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user “Login”. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name. | Medium 4.7 | 17 Aug 2021 |
| CVE-2021-25957 | In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password. | High 8.8 | 17 Aug 2021 |
| CVE-2021-25955 | In “Dolibarr ERP CRM”, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store malicious scripts in the “Private Note” field at “/adherents/note.php?id=1” endpoint. These scripts are executed in a victim’s browser when they open the page containing the vulnerable field. In the worst case, the victim who inadvertently | Critical 9.0 | 15 Aug 2021 |
| CVE-2021-25954 | In “Dolibarr” application, 2.8.1 to 13.0.4 don’t restrict or incorrectly restricts access to a resource from an unauthorized actor. A low privileged attacker can modify the Private Note which only an administrator has rights to do, the affected field is at “/adherents/note.php?id=1” endpoint. | Medium 4.3 | 9 Aug 2021 |
| CVE-2020-35136 | Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php. | High 7.2 | 23 Dec 2020 |
| CVE-2020-14209 | Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism). | High 8.8 | 2 Sep 2020 |
| CVE-2020-13828 | Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with | Medium 5.4 | 31 Aug 2020 |
| CVE-2020-14201 | Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code. | Medium 6.5 | 21 Aug 2020 |
| CVE-2020-14475 | A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey). | Medium 6.1 | 19 Jun 2020 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 2 Last 12 months 4 Lifetime Access control 35 % Injection 25 % XSS/CSRF 22 % File handling 18 % Latest advisories Loading the feed Overview Dolibarr is a volunteer-built ERP and CRM with a very large install base across European small businesses, associations and municipalities, carrying invoicing, accounting and payroll data for organisations that have no security team at all. Its published advisory count is a poor guide to the real rate. The project holds no CNA, does not issue CVEs itself and pushes advisories over its own feed, so the GitHub figure understates what has actually been fixed. Dolibarr ran a paid programme on Yogosha and closed it at the end of 2024, and the association states plainly that it has no funds for bounties. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy takes private reports on any supported version, defining support as the five most recent major releases, and states eligibility rules rather than a component carve-out. Everything shipped in the core tree inside that window is in scope The permission system, which grants rights per module per user and is the single control standing between a limited employee and the company's finances The core modules a real deployment turns on: third parties and contacts, proposals, orders, invoices, accounting, stock, projects, HR and expense reports The public-facing interfaces Dolibarr exposes to unauthenticated visitors, including public ticket submission, online payment pages and online signature links The REST API and the API key mechanism scripted consumers authenticate with The document generation layer, which renders ODT and PDF output from templates that an administrator can edit The electronic content management module and every upload and download route that touches the documents directory The multicompany arrangement, where one installation serves several legal entities out of one database External authentication connectors, including LDAP and any single sign-on module in the core tree The installer and the upgrade path, plus the module activation mechanism that enables new code on a running instance List views, search filters and the SQL those parameters are built into Email sending and the mass-mailing module, including any template a user supplies Out of scope Modules from Dolistore and other external module authors, which ship outside the core repository Releases older than the five most recent majors, the support window the policy defines A permission grant an administrator made deliberately, since the module permission matrix is a configuration decision Upstream PHP library issues, unless Dolibarr's own use of the library is what makes the defect reachable Hosting and server configuration, including a web root that exposes the documents directory Scanner output submitted without a working reproduction against a supported release Most-valued findings Permission-matrix bypass, where a user without the right for a module reaches its data or its actions anyway. This is the highest-value class in a product whose entire authorisation model is that matrix Anything reachable from the unauthenticated public interfaces: the public ticket form, the online payment page and the signature links, since those are the parts of Dolibarr exposed to the open internet on purpose SQL injection through list filters, search parameters or sort arguments, which in this codebase are assembled into queries across a very large number of module screens Path traversal and unauthorised retrieval in the document module, where invoices, payslips and contracts sit as files on disk File upload handling that lands an executable file somewhere the web server will run it Cross-entity access on a multicompany installation, where one legal entity's accounting reaches another's Template injection in the ODT or PDF generation path, where an administrator-editable template becomes code execution Authentication and session defects, including the LDAP connector and password reset Stored cross-site scripting in a third-party record, an invoice note or a ticket message that later renders in an administrator's session Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Prefer a GitHub private security advisory on Dolibarr/dolibarr, the channel the policy recommends first. [email protected] is the documented alternative The old Yogosha programme link is still sitting in the SECURITY.md source inside an HTML comment. It closed at the end of 2024, it is invisible in the rendered page, and following it wastes your time The policy defines support as the five most recent major versions. A finding against anything older falls outside it The policy asks security testers to append -securitytest-for-dolibarr to their User-Agent string so the project can tell research traffic from a live attack. Do it Say which modules were enabled. Dolibarr is heavily modular and most of the product is optional, so a reproduction depends on the module set as much as on the version Advisories go out on the project's own feed at cti.dolibarr.org rather than as CVEs, so expect credit there rather than in the CVE database Disclosure Coordinated privately with a volunteer maintainer group through GitHub private advisories or the security address, then published on the project's own security feed. Dolibarr holds no CNA and does not assign CVE identifiers itself, so a finding may never receive one unless a third party steps in. The five-major-version support window decides which branches get a backport. Hold the detail until the fixed releases are out across that window, since the install base runs several majors behind at any moment. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability