Is CVE-2026-116219 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116219 being exploited in the wild.

How severe is CVE-2026-116219?

High severity, with a CVSS score of 7.2, published 26 October 2026.

Which products and versions are affected?

Dolibarr ERP CRM before 24.0.0.

Is there a fix for CVE-2026-116219?

Yes: fixed in 24.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116219 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116219?

Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116219: Dolibarr ERP CRM OS command injection in export.php

CVE-2026-116219 · Severity: high · CVSS 7.2 · Published 2026-10-26

Dolibarr ERP CRM is an open-source business management system that handles invoices, orders, inventory, and accounting. An authenticated administrator can inject operating system commands through the database export tool, allowing them to execute arbitrary code on the server hosting the application. This could lead to complete compromise of the server and all business data it contains.

Technologies: Dolibarr ERP CRM. Vendors: Dolibarr.

Quick answers

Is CVE-2026-116219 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116219 being exploited in the wild.
How severe is CVE-2026-116219?: High severity, with a CVSS score of 7.2, published 26 October 2026.
Which products and versions are affected?: Dolibarr ERP CRM before 24.0.0.
Is there a fix for CVE-2026-116219?: Yes: fixed in 24.0.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116219 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116219?: Check whether you run Dolibarr ERP CRM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 24.0.0

Technical details

The vulnerability is an OS command injection flaw in htdocs/admin/tools/export.php where user-supplied mysqldump parameters bypass the restrict_os_commands allowlist by chaining commands with the & character around an allowlisted basename. An authenticated admin-level attacker can execute arbitrary operating system commands with the privileges of the web server process, requiring only admin access and HTTP network connectivity to the application.

Affected products

Dolibarr ERP CRM before 24.0.0

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.