CVE-2026-116219
Dolibarr ERP CRM before 24.0.0 OS command injection lets authenticated admins run commands (CVE-2026-116219)
Dolibarr ERP CRM before 24.0.0 has an OS command injection in the admin export tool. An authenticated administrator can chain commands around an allowlisted mysqldump value and execute OS commands as the web server user. Upgrade to 24.0.0.
What happened
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability (CWE-78) in the administrative export tool at htdocs/admin/tools/export.php. The restrict_os_commands allowlist is intended to constrain which operating system commands an administrator can run through the export function, but an authenticated administrator can submit a mysqldump value that chains additional commands with & characters around an allowlisted basename. This bypasses the allowlist and executes operating system commands as the web server user.
The CVSS 4.0 vector scores this 8.6, high severity. It is network-reachable with low attack complexity and no user interaction, but it requires high privileges: an administrator account. Successful exploitation gives high impact to confidentiality, integrity and availability of the host. The CVE record does not list exploitation or public disclosure.
Who is affected
Dolibarr ERP CRM before 24.0.0. Any deployment running a release before 24.0.0 is affected. This is the ERP/CRM product's web-based administration and export area, normally used by authorised administrators.
What to do now
- Upgrade to Dolibarr 24.0.0. This is the only fixed release listed.
- Until the upgrade is complete, restrict access to the Dolibarr admin interface to known, trusted administrators and audit administrator accounts for unexpected activity.
- After upgrading, review server processes and scheduled export jobs for unusual commands or child processes running as the web server user.
No vendor workaround is published.
How to detect it
No vendor indicators of compromise are published. Because the vulnerable function runs from htdocs/admin/tools/export.php and executes commands as the web server user, monitor for unexpected processes spawned by the web server user after administrative export activity, especially command lines containing & around mysqldump.
Beyond the patch
This is an authenticated admin function that leads to command execution as the web server user, so patch urgency is high even though it requires elevated privileges. A penetration test or hardening assessment is the right place to find injection flaws such as this before abuse occurs; Implementation & Assessment Services does exactly that. For organisations managing many ERP/CRM instances, the window between the upstream fix and your production upgrade is a supply-chain exposure decision: Supply Chain Defense & Third-Party Risk helps track the software you run and how quickly fixes reach it.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| dolibarr | – < 24.0.0 | 24.0.0 |