All vulnerabilities
CVE-2026-116219

Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

Dolibarr dolibarr
Open in ThreatlineRecord JSON
CVSS
8.6High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in24.0.0Fixed versionCVE List
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

Text from CVE List

Affected versions 2

  • dolibarraffected: all versions before 24.0.0CVE List
  • dolibarrunaffected: 24.0.0CVE List

References 5