Dolibarr ERP CRM EUVD-2026-109811

Requires an authenticated Dolibarr administrator (PR:H) with access to the admin database export/backup tool at htdocs/admin/tools/export.php. The attacker supplies a malicious 'mysqldump' command value; even though the restrict_os_commands feature enforces a basename allowlist, pre-patch code only ran dol_sanitizePathName and did not strip shell metacharacters, so commands chained with '&' around an allowlisted basename pass the check and execute. Limiting factors: administrative authentication is mandatory, exploitation operates through the export feature path, resulting commands run only with the web server user's privileges (no scope change to other systems), and versions 24.0.0 and later apply dol_string_nospecial sanitization that removes | ; < > & + and blocks the technique.

This is a genuine but conditional risk that the signals consistently rate as important-not-urgent rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 (High) and correctly reflects the core limiter: PR:H means exploitation requires high privilege - specifically an authenticated Dolibarr administrator - so this is a post-authentication privilege-to-OS escalation, not an internet-facing unauthenticated RCE. Once that bar is met, attack complexity is low and impact is full (arbitrary command execution as the web server user). The vuln.today decision label is 'this_week', consistent with a serious issue carrying a non-trivial precondition. No EPSS score, no CISA KEV listing, and no confirmed public exploit code were supplied, so there is no evidence of active or at-scale exploitation; exploitation status is best read as no public exploit identified at time of analysis. The practical risk is therefore highest in multi-user Dolibarr deployments where 'administrator' is a shared or loosely governed role, or where an attacker can first phish/compromise an admin account - in those settings a merely-administrative actor converts into OS code execution and a host foothold. A single all-powerful admin with no other users gains comparatively little new capability. No signals conflict here; the main caveat is the absence of EPSS/KEV/PoC data, which limits confidence about real-world exploitation frequency.

An attacker who already holds (or has phished/hijacked) a Dolibarr administrator session opens the database export tool and submits a crafted 'mysqldump' value that wraps an allowlisted command basename with '&'-chained shell commands, defeating the restrict_os_commands allowlist. When Dolibarr runs the backup, the injected commands execute as the web server user, giving the attacker arbitrary OS command execution on the host. No confirmed public exploit code was provided, though VulnCheck published an advisory and the vulnerable source lines are referenced.