Skip to content
OpenAdvisories
Critical USN-8448-1 1 CVE

dolibarr vulnerability

Published Jun 17, 2026 · Updated Jun 18, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Dolibarr incorrectly handled user-supplied
database name values during installation. A remote attacker could
possibly use this issue to execute arbitrary code.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS dolibarr 3.5.8+dfsg1-1ubuntu1+esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2018-25357

    Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php

    Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PH…

    Dolibarr Dolibarr ERP/CRM dolibarr dolibarr/dolibarr Ubuntu Packagist

References

  • report
    https://ubuntu.com/security/CVE-2018-25357