CVE-2026-116219 in Dolibarr
Summary
by MITRE • 10/26/2026
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability resides within the Dolibarr ERP and CRM software, specifically affecting versions prior to 24.0.0 in the file htdocs/admin/tools/export.php. This component is responsible for handling data export operations, a critical function for administrative users who require access to system data for backup or analysis purposes. The core technical flaw stems from improper neutralization of special elements used in operating system commands, commonly referred to as OS command injection. While the application implements an allowlist mechanism intended to restrict which external programs can be executed via the export feature, this security control is flawed and easily bypassed by a sophisticated attacker who possesses valid administrative credentials.
The specific technical weakness allows an authenticated administrator to inject malicious payloads into the mysqldump utility invocation. By leveraging shell metacharacters such as ampersands (&), which are used for command chaining in Unix-like operating systems, an attacker can append additional commands after the intended database dump operation. For instance, if the allowlist permits the execution of mysqldump with a specific basename parameter, the attacker can structure their input to execute that allowed binary while simultaneously triggering secondary commands through the shell interpreter. This technique effectively circumvents the restrictive OS command whitelist because the validation logic likely checks only the primary executable name rather than sanitizing or validating the entire argument string passed to the system call interface.
From a threat modeling perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and is categorized under ATT&CK technique T1059 Command and Scripting Interpreter within the Execution tactic. The ability to chain commands using shell operators like ampersands allows for arbitrary code execution on the underlying host system. Since the export functionality typically runs with the privileges of the web server process, successful exploitation grants the attacker a foothold as that user. This can lead to significant operational impacts including unauthorized access to sensitive business data stored in the database, potential pivoting to other systems within the network if the web server is compromised further, and complete loss of integrity for the ERP system's configuration and records.
Mitigation strategies must focus on both immediate remediation and long-term secure coding practices. The primary solution is to upgrade Dolibarr to version 24.0.0 or later where this vulnerability has been addressed by developers through stricter input validation and proper escaping mechanisms. In environments where upgrading is not immediately feasible, administrators should consider disabling the export functionality entirely if it is not strictly required for business operations. Additionally, implementing a Web Application Firewall with rules capable of detecting shell metacharacter injection patterns can provide an additional layer of defense against exploitation attempts. It is also advisable to review and harden the allowlist configuration by ensuring that only necessary binaries are permitted and considering the use of safer APIs such as exec or system functions with properly escaped arguments rather than relying solely on filename-based whitelisting which is prone to interpretation ambiguities in shell environments.