PT-2026-33987 · Unknown · Dolibarr Erp/Crm

Published 2026-04-21 · Updated 2026-04-22 · CVE-2026-31019

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dolibarr ERP & CRM versions prior to 22.0.5

Description In the Website module, the application employs blacklist-based filtering to restrict dangerous PHP functions associated with system command execution. An authenticated user with permissions to edit PHP content can bypass this filtering, leading to remote code execution and the ability to execute arbitrary operating system commands on the server.

Recommendations Update to a version newer than 22.0.4.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-31019

Affected Products

Dolibarr Erp/Crm

References · 7

• 🔥 https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31019 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31019 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31019 · Security Note
• https://ubuntu.com/security/CVE-2026-31019 · Vendor Advisory
• http://dolibarr.com · Note
• https://twitter.com/CVEnew/status/2046601502588903713 · Twitter Post