CVE-2026-31019

Website Module Bypass Enables Remote Code Execution in Dolibarr ERP & CRM

Published Apr 21, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.

Analysis

Technical impact

In Dolibarr ERP & CRM versions 22.0.4 and earlier, the Website module relies on a blacklist of PHP functions to prevent dangerous operations. An authenticated user granted permission to edit PHP content can sidestep this filtering, allowing execution of arbitrary system commands. This flaw enables a malicious actor to gain full code execution on the host server, compromising confidentiality, integrity, and availability of the entire system.

Affected Systems

Dolibarr ERP & CRM (Website module), specifically any installation using version 22.0.4 or earlier.

Risk and Exploitability

The vulnerability carries a high severity rating; the CVSS score of 8.8 indicates high severity, and the ability to execute arbitrary commands gives attackers complete control over the underlying operating system. No EPSS score is available, so precise exploitation probability is unknown. The flaw is not listed in the CISA KEV catalog, yet it remains a critical risk for any environment where users can edit PHP files without stringent controls.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:dolibarr:dolibarr_erp\/crm:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Dolibarr

Version	Status	Scheme	Platform
`[0,22.0.4]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest official update to Dolibarr ERP & CRM to remove the vulnerability. If no update is yet available, upgrade to a version newer than 22.0.4.
Limit or remove permission for users to edit PHP content in the Website module until the patch is applied.
Configure the PHP runtime to disable dangerous functions such as system, exec, shell_exec, popen, and proc_open, and enforce a strict whitelist of allowed operations.

Generated by OpenCVE AI on April 22, 2026 at 07:35 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-j2g9-rprv-hrhc	Dolibarr user with permission to edit PHP content can bypass filtering to restrict dangerous PHP functions

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.572% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.md

History

Apr 23, 2026 4:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dolibarr dolibarr Erp\/crm
CPEs		cpe:2.3:a:dolibarr:dolibarr_erp\/crm::::::::
Vendors & Products		Dolibarr dolibarr Erp\/crm

Apr 22, 2026 8:00 AM Title updated View changes

Type	Values Removed	Values Added
Title		Website Module Bypass Enables Remote Code Execution in Dolibarr ERP & CRM

Apr 22, 2026 6:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Authenticated Remote Code Execution via PHP Function Blacklist Bypass in Dolibarr Website Module
Weaknesses	CWE-94

Apr 22, 2026 12:00 AM Title updated. Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		Authenticated Remote Code Execution via PHP Function Blacklist Bypass in Dolibarr Website Module
Weaknesses		CWE-78 CWE-94
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 21, 2026 5:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dolibarr Dolibarr dolibarr
Vendors & Products		Dolibarr Dolibarr dolibarr

Apr 21, 2026 3:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.
References		http://dolibarr.com https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.md