Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck
CVE-2026-116219Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter
High 7.2
In plain English
A high-severity OS command injection in dolibarr from Dolibarr. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- Patch Commit patch
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L129-L154 technical-description
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.php#L322-L327 technical-description
- https://github.com/Dolibarr/dolibarr product
- VulnCheck Advisory: Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter third-party-advisory