OS Command Injection in Dolibarr ERP CRM Affects Administrators

CVE-2026-116219

What is CVE-2026-116219?

Dolibarr ERP CRM prior to version 24.0.0 is vulnerable to OS command injection in htdocs/admin/tools/export.php, enabling authenticated administrators to exploit the issue. Attackers may leverage this vulnerability by submitting a crafted mysqldump value that incorporates command chaining using '&' characters. This manipulation bypasses the restrict_os_commands allowlist, allowing execution of arbitrary operating system commands under the context of the web server user. Proper patching and precautionary measures are essential to mitigate any risks associated.

References