Vulnerability Description
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.p
- https://github.com/Dolibarr/dolibarr/commit/e4c593e0f9f109dd708be0f1d62a51712d36
- https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.0-os-command-i
FAQ
What is CVE-2026-116219?
CVE-2026-116219 is a vulnerability with a CVSS score of 7.2 (HIGH). Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attacke...
How severe is CVE-2026-116219?
CVE-2026-116219 has been rated HIGH with a CVSS base score of 7.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116219?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.