7.2
HighCVSS 3.1 · from VulnCheck
CVE-2026-116219
Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
dolibarr · OS command injection · CWE-78Affecteddolibarr
FixUpdate to 24.0.0 or newer
PublishedOct 26, 13:08 · VulnCheck
ScoredOct 26 · 7.2 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed indolibarrbefore 24.0.024.0.0dolibarrNot affected24.0.0
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known