Description
Dolibarr ERP CRM 7.0.3 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP code through the db_name parameter. Attackers can send a POST request to install/step1.php with malicious PHP code in the db_name parameter, then execute commands via the check.php endpoint using the cmd GET parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dolibarr | Dolibarr ERP CRM | ≤ 7.0.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | 3.5.8+dfsg1-1ubuntu1+esm1 | USN-8448-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | dolibarr/dolibarr | >= 7.0.0, < 7.0.4 | 7.0.4 | GHSA-hxmh-2xc4-c894 |
| Packagist | dolibarr/dolibarr | < 6.0.8 | 6.0.8 | GHSA-hxmh-2xc4-c894 |
Advisories 1
- USN-8448-1 dolibarr vulnerability Ubuntu Security Notices (USN) · Jun 18, 2026
References
- ExploitDB-44964 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: Dolibarr ERP CRM 7.0.3 Remote Code Evaluation via install/step1.php third-party-advisory