Dolibarr ERP/CRM: OS command injection via mysqldump parameter
Summary
Dolibarr ERP/CRM before 24.0.0 contains an OS command injection flaw in the database export tool (htdocs/admin/tools/export.php). An authenticated administrator can bypass the restrict_os_commands allowlist by supplying a mysqldump value that chains commands with & characters around an allowlisted basename. Successful exploitation executes operating system commands as the web server user.
Affected
- Dolibarr ERP/CRM versions 0 to before 24.0.0
- Affected versions include 23.x releases (no backport to 23.x confirmed by sources)
Fixed in
- Fixed in Dolibarr ERP/CRM 24.0.0
- Recommended: latest 24.x release (CVE-2026-118754 is fixed in 24.0.2)
Workaround
- No vendor workaround known.
- Limit access to the /admin area to trusted networks or a VPN.
Exploitation
- Requires administrator privileges (PR:H).
- No public proof of concept found.
- Not known to be exploited in the wild; not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade Dolibarr to 24.0.0 or later, preferably the latest 24.x release.
- Enforce strong, unique administrator passwords and MFA where possible, and review existing admin accounts.
- Restrict access to Dolibarr admin pages to trusted networks.
- Check web server and database hosts for unexpected processes or files.
- If Dolibarr is installed from Ubuntu or another distribution package, check the distribution security tracker for a fixed package.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Fix commit github.com
- Vulnerable code at tag 23.0.3 github.com
- Ubuntu CVE tracker ubuntu.com
- OffSeq radar entry radar.offseq.com
- HOL Guard CVE entry hol.org
- Strix CVE entry www.strix.ai
- Dolibarr GitHub repository github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:07.
Original description (NVD)
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
NVD references (5)
- https://github.com/Dolibarr/dolibarr
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L129-L154
- https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.php#L322-L327
- https://github.com/Dolibarr/dolibarr/commit/e4c593e0f9f109dd708be0f1d62a51712d36823a
- https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.0-os-command-injection-via-mysqldump-parame…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.