CVE-2026-116219— Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

Quick assessment

Affected

Dolibarr dolibarr

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dolibarr ERP CRM 24.0.0 之前的版本在文件中存在操作系统命令注入漏洞。已认证的管理员可利用该漏洞绕过白名单限制。攻击者可通过提交包含的值，利用字符在已白名单化的基础文件名周围拼接命令，从而以 Web 服务器用户的身份执行操作系统命令。

CVSS 7.2 · High Updated Oct 26, 2026

Possible ATT&CK Techniques 2 AI

T1059.004 · Unix Shell T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dolibarr ERP CRM before 24.0.0 OS Command Injection via mysqldump Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Dolibarr	dolibarr	0 ~ 24.0.0	-

II. Public POCs for CVE-2026-116219

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116219

请登录查看更多情报信息。

Other References for CVE-2026-116219 (4)

https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/core/class/utils.class.php#L322-L327 technical-description
https://github.com/Dolibarr/dolibarr/blob/23.0.3/htdocs/admin/tools/export.php#L129-L154 technical-description
https://github.com/Dolibarr/dolibarr/commit/e4c593e0f9f109dd708be0f1d62a51712d36823a patch
https://www.vulncheck.com/advisories/dolibarr-erp-crm-before-24.0.0-os-command-injection-via-mysqldump-parameter third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116219

IV. Related Vulnerabilities

Same product: dolibarr

Same vendor: Dolibarr

Same weakness: CWE-78