CVE-2026-34036 | Dolibarr up to 22.0.4 AJAX Endpoint selectobject.php restrictedArea objectdesc filename control (GHSA-2mfj-r695-5h9r)

A vulnerability has been found in Dolibarr up to 22.0.4 and classified as problematic. This affects the function restrictedArea of the file /core/ajax/selectobject.php of the component AJAX Endpoint. This manipulation of the argument objectdesc causes improper control of filename for include/require statement in php program (‘php remote file inclusion’).

This vulnerability is handled as CVE-2026-34036. The attack can be initiated remotely. There is not any exploit available.

Applying a patch is the recommended action to fix this issue.