Dolibarr ERP CRM OS command injection lets authenticated admins execute commands (CVE-2026-116219)

What happened

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php. The export function is designed to enforce a list of permitted operating system commands, but a user with administrator privileges can submit a mysqldump value that chains additional commands with & characters around an allowed basename. This bypasses the restrict_os_commands allowlist and executes arbitrary operating system commands as the web server user.

The vulnerability is rated high severity with a CVSS 4.0 score of 8.6. It is reachable over the network, requires administrator-level access, and needs no user interaction. Confidentiality, integrity and availability impacts on the vulnerable system are high. No exploitation is recorded in the CVE record.

Who is affected

Dolibarr ERP CRM installations before version 24.0.0 are affected. Dolibarr is typically run as a self-hosted ERP and CRM platform, and the vulnerable code is in the admin export tool. Organisations that expose Dolibarr's administrative interface or have multiple administrator accounts should treat the installation as affected until upgraded.

What to do now

1. Apply the vendor fix: upgrade to dolibarr 24.0.0.
2. If you cannot upgrade immediately, restrict network access to the Dolibarr admin interface and remove or disable administrator accounts that do not need export access.
3. Review administrator accounts and export-tool logs for unexpected mysqldump activity.
4. No separate workaround is published; the upgrade is the known remediation.

How to detect it

Review export-tool logs for mysqldump values containing & characters around an allowed command basename. Monitor administrator authentication and export activity, since exploitation requires an administrator account. The described technique executes commands as the web server user.

Beyond the patch

This is a reminder that an administrator account is not a trust boundary once credentials are misused or taken over. An implementation assessment can test and harden export and command-handling paths before a vulnerability reaches production; penetration testing typically surfaces injection flaws like this one. Because Dolibarr is often self-hosted, tracking which versions you run and how quickly the vendor fixes them is supply-chain work. Our Implementation & Assessment Services and Supply Chain Defense & Third-Party Risk cover those two jobs.