CVE-2020-14209

Dolibarr before 11.0.5 allows low-privilege users to upload files of dangerous types, leading to arbitrary code execution. This occurs because .pht and .phar files can be uploaded. Also, a .htaccess file can be uploaded to reconfigure access control (e.g., to let .noexe files be executed as PHP code to defeat the .noexe protection mechanism).

• CWE-434

• http://packetstormsecurity.com/files/161955/Dolibarr-ERP-CRM-11.0.4-Bypass-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Dolibarr/dolibarr/releases/tag/11.0.5Release Notes, Third Party Advisory
• https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-012Third Party Advisory
• http://packetstormsecurity.com/files/161955/Dolibarr-ERP-CRM-11.0.4-Bypass-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/Dolibarr/dolibarr/releases/tag/11.0.5Release Notes, Third Party Advisory
• https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2020-012Third Party Advisory

Published

Sep 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14203WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site…8.8
• CVE-2020-14204In WebFOCUS Business Intelligence 8.0 (SP6), the administrat…8.2
• CVE-2020-14205The DiveBook plugin 1.1.4 for WordPress is prone to improper…5.3
• CVE-2020-14206The DiveBook plugin 1.1.4 for WordPress is prone to unauthen…6.1
• CVE-2020-14207The DiveBook plugin 1.1.4 for WordPress was prone to a SQL i…5.3
• CVE-2020-14208SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting …5.4
• CVE-2020-1421A remote code execution vulnerability exists in Microsoft Wi…8.8
• CVE-2020-14210Reflected Cross-Site Scripting (XSS) vulnerability in MONITO…6.1
• CVE-2020-14212FFmpeg through 4.3 has a heap-based buffer overflow in avio_…8.8
• CVE-2020-14213In Zammad before 3.3.1, a Customer has ticket access that sh…5.4
• CVE-2020-14214Zammad before 3.3.1, when Domain Based Assignment is enabled…6.5
• CVE-2020-14215Zulip Server before 2.1.5 has Incorrect Access Control becau…7.5