Vulnerability GHSA-hxmh-2xc4-c894
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
5 months ago
May 26, 2026 at 01:30 PM UTC
Dolibarr ERP CRM contains a remote code evaluation vulnerability
3.6.0-beta - 6.0.7 and 7.0.0 - 7.0.3
3.6.0-beta - 6.0.7 and 7.0.0 - 7.0.3
Summary
Dolibarr ERP CRM contains a remote code evaluation vulnerability
Details
Dolibarr ERP CRM 7.0.3 contains a remote code evaluation vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
9 days ago
Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter
3.6.0-beta - 15.0.3 GHSA-v5fq-cf5m-vwv7
3.6.0-beta - 15.0.3 GHSA-v5fq-cf5m-vwv7
Medium Risk
5 months ago
Dolibarr ERP CRM is vulnerable to Improper Authorization through its Leave Request REST API
3.6.0-beta - 15.0.3 GHSA-7fg5-vc77-69fp
3.6.0-beta - 15.0.3 GHSA-7fg5-vc77-69fp
Low Risk
6 months ago
Dolibarr has Insufficient Verification of Data Authenticity
3.6.0-beta - 15.0.3 GHSA-jggh-5rmh-r6h5
3.6.0-beta - 15.0.3 GHSA-jggh-5rmh-r6h5
Medium Risk
6 months ago
Dolibarr has an Injection issue
3.6.0-beta - 15.0.3 GHSA-rvwr-q5hj-wq7g
3.6.0-beta - 15.0.3 GHSA-rvwr-q5hj-wq7g
High Risk
6 months ago
Dolibarr Allows Code Injection through its Website Module
3.6.0-beta - 15.0.3 GHSA-676v-wh57-p375
3.6.0-beta - 15.0.3 GHSA-676v-wh57-p375
Impacted packages
Timeline
Published
5 months ago
May 26, 2026 at 01:30 PM UTC
Fixed (6.0.8)
8 years ago
October 12, 2018 at 03:42 PM UTC
Fixed (7.0.4)
8 years ago
October 12, 2018 at 05:13 PM UTC
Last Modified
1 month ago
September 10, 2026 at 03:51 AM UTC