EUVD-2026-24135
GHSA-j2g9-rprv-hrhc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.
AnalysisAI
Remote code execution in Dolibarr ERP 22.0.4 and earlier allows authenticated users with PHP content editing permissions to execute arbitrary OS commands on the server. The vulnerability stems from a bypassable blacklist-based filter for dangerous PHP functions in the Website module. Attack complexity is low (CVSS AV:N/AC:L/PR:L), requiring only valid low-privilege credentials. Public proof-of-concept code exists on GitHub, though CISA has not confirmed active exploitation. EPSS data is unavailable, but SSVC assessment indicates total technical impact with no current exploitation evidence.
Technical ContextAI
This vulnerability affects the Website module in Dolibarr ERP & CRM, an open-source business management application written in PHP. The root cause is CWE-78 (OS Command Injection), where the application attempts to sanitize user-supplied PHP code by blacklisting dangerous functions like system(), exec(), shell_exec(), and similar command execution primitives. Blacklist-based filtering is inherently insecure because attackers can use alternative methods to execute commands: PHP backtick operators, proc_open(), pcntl_exec(), assert() with dynamic code, or obfuscation techniques like variable functions and string concatenation. Since users with Website module editing rights can inject arbitrary PHP code into templates or pages, bypassing the incomplete blacklist provides full server-side code execution with the web server's privileges.
RemediationAI
Upgrade to Dolibarr ERP version 22.0.5 or later once the vendor releases a patched version addressing the blacklist bypass. As of this analysis, vendor advisory at dolibarr.com should be consulted for exact fixed version availability. Until patches are deployed, implement these compensating controls: (1) Audit and restrict Website module permissions to only essential administrative users through the Dolibarr permission system - this significantly reduces attack surface but impacts users who legitimately need to edit web content. (2) Disable the Website module entirely if not business-critical - this eliminates the attack vector but removes all website publishing functionality. (3) Deploy web application firewall rules to detect and block PHP command execution patterns in POST requests to Website module endpoints - effectiveness depends on WAF signature coverage and may generate false positives with legitimate PHP code. (4) Enable PHP's disable_functions directive at the server level to block shell execution functions globally - this provides defense-in-depth but may break legitimate application features and requires PHP configuration access. None of these workarounds fully address the underlying code vulnerability.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today