{"id":"CVE-2026-116219","kind":"vulnerability","aliases":["CVE-2026-116219"],"related":[],"title":"Dolibarr ERP CRM: admin export lets authenticated users run OS commands","description":"Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.","summary":"Dolibarr ERP CRM before 24.0.0 has an OS command injection in htdocs/admin/tools/export.php. An authenticated administrator can bypass the restrict_os_commands allowlist by chaining commands with & around an allowed basename in the mysqldump value, running commands as the web server user.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dolibarr","package","php","self-hosted"],"not_affected_if":["auth-required","upgraded-to-24.0.0"],"how_to_check":"- Check the installed Dolibarr version (`htdocs/filefunc.inc.php` or the About page) and see whether it is below `24.0.0`\n- Look for the `restrict_os_commands` setting in `conf/conf.php` and note its value","fix":"- Upgrade Dolibarr to `24.0.0` or later\n- Until upgraded, restrict admin accounts to trusted users and review who holds admin rights","status":"open","published_at":"2026-10-26T14:16:35+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:17+00:00","updated_at":"2026-10-26T14:32:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-26T14:32:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Dolibarr to `24.0.0` or later\n- Until upgraded, restrict admin accounts to trusted users and review who holds admin rights","reach":"internet","title":"Dolibarr ERP CRM: admin export lets authenticated users run OS commands","impact":"high","summary":"Dolibarr ERP CRM before 24.0.0 has an OS command injection in htdocs/admin/tools/export.php. An authenticated administrator can bypass the restrict_os_commands allowlist by chaining commands with & around an allowed basename in the mysqldump value, running commands as the web server user.","category":"package","nicknames":[],"who_cares":["dolibarr","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Commands run as the web server user on the host","analyst_note":"Confirm the affected version range and the exact fixed release from the NVD entry and the Dolibarr project advisory.","how_to_check":"- Check the installed Dolibarr version (`htdocs/filefunc.inc.php` or the About page) and see whether it is below `24.0.0`\n- Look for the `restrict_os_commands` setting in `conf/conf.php` and note its value","needs_analyst":true,"not_affected_if":["auth-required","upgraded-to-24.0.0"],"who_is_affected":"Dolibarr installations before 24.0.0 where users with administrator rights can reach the export tool in the admin tools section. The attacker needs an authenticated admin account, so exposure depends on how many people hold that role and whether accounts are protected. Instances already on 24.0.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000635,"input_tokens":3350,"output_tokens":600,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116219':14A,17A '-2026':13A,16A '24.0.0':28B,69C 'admin':4A 'administr':38B,81C 'allow':52B 'allowlist':45B,87C,100C 'around':50B,98C 'attack':88C 'authent':7A,37B,80C 'basenam':53B,101C 'bypass':40B,82C 'chain':47B,94C 'charact':97C 'command':11A,32B,44B,48B,59B,73C,86C,95C,106C 'contain':70C 'crm':3A,26B,67C 'cve':12A,15A 'dolibarr':1A,18B,24B,65C 'erp':2A,25B,66C 'execut':103C 'export':5A 'host':23B 'htdocs/admin/tools/export.php':35B,77C 'inject':33B,74C 'let':6A,79C 'mysqldump':56B,92C 'oper':104C 'os':10A,31B,43B,72C,85C 'packag':19B 'php':20B 'restrict':42B,84C 'run':9A,58B 'self':22B 'self-host':21B 'server':63B,110C 'submit':90C 'system':105C 'user':8A,64B,111C 'valu':57B,93C 'vulner':75C 'web':62B,109C","nicknames":[],"mitigations":[],"who_affected":"Dolibarr installations before 24.0.0 where users with administrator rights can reach the export tool in the admin tools section. The attacker needs an authenticated admin account, so exposure depends on how many people hold that role and whether accounts are protected. Instances already on 24.0.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T14:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116219","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116219","severity":null,"published_at":"2026-10-26T14:16:35+00:00","modified_at":"2026-10-26T14:16:35+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}