Is CVE-2026-31019 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-31019 being exploited in the wild.

How severe is CVE-2026-31019?

High severity, with a CVSS score of 8.8, published 21 April 2026.

Which products and versions are affected?

Dolibarr ERP CRM <= 22.0.4; dolibarr/dolibarr (Packagist) ECOSYSTEM:introduced=0,last_affected=22.0.4.

Is there a fix for CVE-2026-31019?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-31019 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-31019?

Check whether you run Dolibarr Crm, Dolibarr Erp\, Dolibarr ERP CRM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31019: Dolibarr ERP & CRM RCE via blacklist bypass in Website module

Q: Which products and versions are affected?

Dolibarr ERP CRM <= 22.0.4; dolibarr/dolibarr (Packagist) ECOSYSTEM:introduced=0,last_affected=22.0.4.

Q: Is there a fix for CVE-2026-31019?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-31019 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-31019?

Check whether you run Dolibarr Crm, Dolibarr Erp\, Dolibarr ERP CRM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-31019 · Severity: high · CVSS 8.8 · Published 2026-04-21

A security vulnerability exists in Dolibarr ERP & CRM, a popular open-source suite for managing business operations like sales and inventory. An authorized user with permission to edit website content can bypass security filters to run unauthorized commands on the underlying server. This could lead to a total takeover of the system, allowing attackers to steal sensitive business data, modify records, or disrupt operations.

Technologies: Dolibarr Crm, Dolibarr Erp\, Dolibarr ERP CRM, dolibarr/dolibarr (Packagist). Vendors: Dolibarr, Packagist.

Quick answers

Is CVE-2026-31019 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-31019 being exploited in the wild.
How severe is CVE-2026-31019?: High severity, with a CVSS score of 8.8, published 21 April 2026.
Which products and versions are affected?: Dolibarr ERP CRM <= 22.0.4; dolibarr/dolibarr (Packagist) ECOSYSTEM:introduced=0,last_affected=22.0.4.
Is there a fix for CVE-2026-31019?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-31019 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-31019?: Check whether you run Dolibarr Crm, Dolibarr Erp\, Dolibarr ERP CRM or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Remote Code Execution (RCE) vulnerability exists in the Website module of Dolibarr ERP/CRM versions up to and including 22.0.4. The application implements a blacklist-based filtering mechanism to block dangerous PHP functions (e.g., system, shell_exec, eval) within dynamic web content. However, this filter relies on simple string-based matching which can be bypassed using obfuscation techniques such as string concatenation, encoding, or indirect function invocation. An authenticated attacker with permissions to edit PHP content can leverage these bypasses to execute arbitrary operating system commands with the privileges of the web server. As of the advisory date, the vulnerability is addressed by avoiding blacklist-based security in favor of more robust input validation or disabling dynamic PHP execution.

Affected products

Dolibarr Dolibarr ERP & CRM <= 22.0.4

Identifiers

CVE-2026-31019
GHSA-j2g9-rprv-hrhc

Timeline

2026-02-06: disclosed: Reported to vendor and MITRE
2026-02-12: other: Vendor acknowledged the issue
2026-04-07: other: CVE assigned
2026-04-21: advisory: NVD publication date

References

https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.