Live › vulnerability › CVE-2026-116219
Go to dashboardDolibarr ERP CRM before 24.0.0 has an OS command injection in htdocs/admin/tools/export.php. An authenticated administrator can bypass the restrict_os_commands allowlist by chaining commands with & around an allowed basename in the mysqldump value, running commands as the web server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Dolibarr installations before 24.0.0 where users with administrator rights can reach the export tool in the admin tools section. The attacker needs an authenticated admin account, so exposure depends on how many people hold that role and whether accounts are protected. Instances already on 24.0.0 or later are not affected.
No product ranges from the sources yet.
htdocs/filefunc.inc.php or the About page) and see whether it is below 24.0.0restrict_os_commands setting in conf/conf.php and note its value24.0.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
This page as .md · .json · in your agent: get_signal("CVE-2026-116219")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.