p PatchFirst

CVE-2026-116219

CVE-2026-116219 · Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

CVSS 8.6 · High · EPSS 2.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • dolibarr

    Versions
    • ≥ 0, < 24.0.0: Affected (semver)
    • 24.0.0: Not affected (semver)

    Update to 24.0.0

  • dolibarr Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.5+dfsg1-2
    • 3.5.7+dfsg1-1
    • 3.5.8+dfsg1-1
    • 3.5.8+dfsg1-1ubuntu1
    • 3.5.8+dfsg1-1ubuntu1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →