This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+13 more
Affected surfaces
ReleasePort's take
Moderate signalThis release patches a critical SQL injection vulnerability in the Contract Service List API and blocks server‑side request forgery (SSRF) when using webhooks.
Why it matters: Addresses two high‑severity security issues—SQL injection (severity 90) and SSRF (severity 90)—impacting API and webhook surfaces; immediate mitigation is required for affected deployments.
Summary
AI summaryFixed SQL injection vulnerability in Contract Service List.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Critical |
Fixes SQL injection via operator injection in contract service list. Fixes SQL injection via operator injection in contract service list. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Security | Critical |
Blocks server‑side request forgery (SSRF) when using webhooks. Blocks server‑side request forgery (SSRF) when using webhooks. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Adds validation to prevent overlapping fiscal year dates during accountancy closure. Adds validation to prevent overlapping fiscal year dates during accountancy closure. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Allows reopening a closed fiscal year by editing its information. Allows reopening a closed fiscal year by editing its information. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Proposes the last unclosed exercise when performing annual closing. Proposes the last unclosed exercise when performing annual closing. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Updates export popup height for better usability. Updates export popup height for better usability. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Shows “export full documents” checkbox when changing format in accountancy export. Shows “export full documents” checkbox when changing format in accountancy export. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Corrects due‑date calculation for payment term 45J FDM on the 15th of a month. Corrects due‑date calculation for payment term 45J FDM on the 15th of a month. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Prevents default payment term/type from auto‑filling list filters. Prevents default payment term/type from auto‑filling list filters. Source: llm_adapter@2026-05-26 Confidence: high |
— |
| Bugfix | Medium |
Fixes accounting cache causing silent reference mutation in journals. Fixes accounting cache causing silent reference mutation in journals. Source: llm_adapter@2026-05-26 Confidence: low |
— |
Full changelog
FIX: #36961 - not showing financial data related to task times (#36963)
FIX: #36980 Accounting - Error on create return operation (#36982)
FIX: #37072
FIX: #37118 Add missing require_once for CMailFile and functions2 in advtargetemailing (#37136)
FIX: #37171
FIX: #37259 - Reverse Charge also for non-EEC countries (#37260)
FIX: #37323 Accountancy closure page - Problem with GETPOSTINT cannot read checkbox values properly (#37325)
FIX: #37327 There is no product description displayed in version 22 (#38267)
FIX: #37339 (#37340)
FIX: #37356 Category Products not listed (#38264)
FIX: #37412 Better fix
FIX: #37461 #37511 Accountancy - Bank journal - Problem of cache (#37603)
FIX: #37551 Accounting - Use better rights on create / export entry (#37555)
FIX: #37707
FIX: #37707 Can pay supplier invoices with the same parent company
FIX: #38054 Societe - Export - Problem on stcomm & typent (#38065)
FIX: #38146 Honor tpl override on supplier contacts (#38150)
FIX: #GHSA-39vm-9q4p-6jjg - force disabling module possible on demo only (#37629)
FIX: #GHSA-crgg-h74r-2m8r (#37636)
FIX: #GHSA-crgg-h74r-2m8r (#37637)
FIX: #GHSA-hh5p-m24x-fwx2 block ssrf when using webhooks (#37630)
FIX: #GHSA-hq5j-39f9-qxcv
FIX: #GHSA-hq5j-39f9-qxcv (#37812)
FIX: #GHSA-v5fq-cf5m-vwv7 - Credit Grzegorz Tworek, Sec4check (#37632)
FIX: #GHSA-w5j3-8fcr-h87w (#36868)
FIX: - AccountingAccount cache — silent reference mutation in accounting journals (#37981)
FIX: - Added user filtering for displaying leave in the calendar (#37385)
FIX: - Change of email to send backup (#36742)
FIX: - Fix doc preview in comm card
FIX: - Fix the default filter dates (#37579)
FIX: - If a specific pricing system is applied, the price type is not specified (#37348)
FIX: - Reload page after check holiday for save param (#37410)
FIX: - Save param SYSTEMTOOLS_MYSQLDUMP and SYSTEMTOOLS_POSTGRESQLDUMP (#36791)
FIX: - Select warehouse on propal create (#36745)
FIX: - Select warehouse on propal list (#36746)
FIX: - Show POS in Order and Invoice list (#37364)
FIX: - Twice the check in resource list column (#37342)
FIX: - getModuleDirForApiClass for propal (#37098)
FIX: Entity on group ticket insertion (#37370)
FIX: Fix not manage deposit account when get accounting code to bind when you have not selected a default account for deposit (#37680)
FIX: calculate the files count on ECM when add multiple files in one time (#31866)
FIX: draft invoice paid when add absolute discount == remain to pay (#38104)
FIX: filters on contract services list (#37274)
FIX: product ref was not printed on supplier recurring invoice (#37535)
FIX: remove stock correctly when reception is deleted (like 82e092f)
FIX: use company default RIB when it is defined (#38016)
FIX: API Warehouse : Error 401 when getting warehouse by id (backport from 22)
FIX: Accountancy - Add validation for overlapping fiscal year dates (#36836)
FIX: Accountancy - Not being able to reopen a closed fiscal year by simply editing its information (#36798)
FIX: Accountancy - On annual closing, propose the last exercise not closing (#36797)
FIX: Accountancy - Update height of the export popup (#37206)
FIX: Contract - Wrong button to edit contract odt path (#36965)
FIX: Invoice - Don't show discount on credit note type (#37145)
FIX: Luxembourg VAT rate by default (17% since 2024-01-01) (#37255)
FIX: SQL Error on VAT not defined in product card (#37159)
FIX: SQL Injection via Operator Injection in Contract Service List
FIX: Societe - Wrong control on update of VAT Intra (#37224)
FIX: a param must not come from end user entry.
FIX: autofill price with multicurrency on supplier doc (backport commit 391aca5) (#38028)
FIX: bad tab underlined in display setup (#37489)
FIX: closing an deposit invoice when payment was too high.
FIX: concatenation of labels in extrafields (#36888)
FIX: contact type translation (#36863)
FIX: date saving when using html dates (like with blind-user mode).
FIX: display of DLC/DLUO in tooltip (#37164)
FIX: double transaction db begin (#38033)
FIX: duplicate str_replace() (#37355)
FIX: extrafield selectlist when there is a linked table (#37706)
FIX: finished regex in product import (#36770)
FIX: icon of mastodon social network
FIX: selected default value ko on select_produits_fournisseurs_list()
FIX: show export full documents checkbox on change format in accountancy export (#37468)
FIX: warning accountancy export from external module (#36832)
FIX: warnings with GETPOSTDATE and saverestore (#36886)
FIX: (API, thirdparties) get fixed amount discounts (#37068)
FIX: (ticket) check on TICKET_IMAGE_PUBLIC_INTERFACE (#36833)
FIX: #36493 (#36853) for having parent kit stock changes you need to set PRODUIT_SOUSPRODUITS_ALSO_ENABLE_PARENT_STOCK_MOVE constant. (#36970)
FIX: #36944 father kits with lot (#37089)
FIX: #36989 private mention on ticket pdf (#37079)
FIX: Allow to include spaces in email filename (#37539)
FIX: Backport fix on v20 for result page of compta (/compta/resultat/index.php) (#37127)
FIX: Clean filenames with double spaces (#37256)
FIX: Correct due date calculation for payment term 45J FDM on 15th (#36808)
FIX: Fix mandatory custom fields JS validation in printCommonFooter (#37469)
FIX: Kit Substock return on shipment cancel/delete (#38373)
FIX: MAIN_FEATURES_LEVEL typo errors (#37304)
FIX: Massaction Create Bills from expedition (#36958)
FIX: Prevent default payment term/type from auto-filling list filters (#36765)
FIX: Remove <?=
FIX: Sometimes socid = undefined
FIX: TakePos sometimes thirdpartyid = undefined
FIX: [BOM] Reset date_creation when cloning a BOM" -m "The creation date of the source object was preserved. This fix ensures the new object gets the current timestamp. (#36898)
FIX: align permission checks for product batches with rights class aliases (#37263)
FIX: do not print Extrafields in PDF if printable is 0 (#37789)
FIX: getDolGlobalInt
FIX: inventory qty is not saved if page > 1 (#36804)
FIX: missing code to add Resource to event on creation card (#37002)
FIX: on event create/edit card, when adding a user, the reminder info was lost. (#36857)
FIX: php echo instead of <?
FIX: php8.1 warning in syslog message
New Contributors
- @NL-dev-fr made their first contribution in https://github.com/Dolibarr/dolibarr/pull/36973
- @yveslg made their first contribution in https://github.com/Dolibarr/dolibarr/pull/37153
- @williamdes made their first contribution in https://github.com/Dolibarr/dolibarr/pull/37504
- @bybel made their first contribution in https://github.com/Dolibarr/dolibarr/pull/37550
- @Ni0rd made their first contribution in https://github.com/Dolibarr/dolibarr/pull/37961
- @JoeBiboche made their first contribution in https://github.com/Dolibarr/dolibarr/pull/38029
- @serhiilabs made their first contribution in https://github.com/Dolibarr/dolibarr/pull/38150
Full Changelog: https://github.com/Dolibarr/dolibarr/compare/22.0.4...22.0.5
Security Fixes
- FIX: SQL Injection via Operator Injection in Contract Service List
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dolibarr
Dolibarr ERP CRM is a modern software package to manage your company or foundation's activity (contacts, suppliers, invoices, orders, stocks, agenda, accounting, ...). it's an open source Web application (written in PHP) designed for businesses of any sizes, foundations and freelancers.
Beta — feedback welcome: [email protected]