cnf409/cve-2026-34036Proof-of-concept script demonstrating an authenticated local file inclusion (LFI) vulnerability in Dolibarr via the objectdesc parameter, allowing authenticated users to read arbitrary local files.
Proof-of-concept script for CVE-2026-34036, an authenticated local file inclusion / LFI in Dolibarr.
The issue is reachable through core/ajax/selectobject.php. An authenticated user can abuse the objectdesc parameter to make the application read arbitrary local files on the server.
This repository contains a simple script that logs into Dolibarr, triggers the vulnerable endpoint, and prints the contents of the requested file.
Read the full report here: full write-up on my website
requestsInstall the dependency if needed:
python3 -m pip install requests
Run the script with the target URL, a valid username/password, and the file you want to read:
python3 CVE-2026-34036.py \
--url http://127.0.0.1:8080 \
--username admin \
--password admin \
--file conf/.htaccess
This PoC is provided for educational and authorized security testing purposes only. Do not use it against systems you do not own or do not have explicit permission to test.