Dolibarr ERP CRM versions prior to 24.0.0 contain an OS command injection vulnerability in the export.php module. The application fails to enforce the restrict_os_commands allowlist, allowing authenticated administrators to provide a crafted mysqldump parameter that chains additional commands using & between an allowlisted basename and malicious payload. Once executed, these commands run as the web server user, giving an attacker the ability to read sensitive data, modify configuration, or further compromise the host. The impact spans confidentiality, integrity, and availability, effectively enabling arbitrary system-level actions.

Dolibarr ERP/CRM released before version 24.0.0. These include all 23.x releases and earlier minor series distributed by Dolibarr.

The CVSS scoring of 8.6 labels this flaw as High severity. Although EPSS data is unavailable and it does not appear in the CISA KEV catalog, the requirement for authenticated administrator access still poses a substantial risk in environments where administrative credentials are inadequately protected. The attack vector involves submitting a specially crafted mysqldump parameter via the export interface, with no additional prerequisites beyond admin authentication. Once the exploit runs, the attacker can execute arbitrary operating-system commands with the permissions of the web server process.