The vulnerability is an OS Command Injection flaw in the ODT‑to‑PDF conversion routine of Dolibarr. The code concatenates the MAIN_ODT_AS_PDF configuration constant directly into a shell command and passes it to exec() without sanitization. This allows an authenticated administrator to inject arbitrary operating‑system commands into the command string, resulting in remote code execution on the web server account when any ODT template is processed.

Dolibarr ERP/CRM software, all releases older than 23.0.0, is affected. The flaw resides in the odf.php module and impacts administrators who can set the MAIN_ODT_AS_PDF constant, which is used whenever ODT templates are converted to PDF.

The CVSS score of 9.4 classifies it as Critical. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting it may not yet be widely exploited. However, the exploit requires only valid administrator credentials and can be triggered during normal template generation, giving attackers immediate remote code execution on the web server. The weakness is categorized as CWE‑78.