CVE-2026-31019
Last modified
CVE-2026-31019 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.. EPSS estimates a 0.63% chance of exploitation in the next 30 days.
Description
In the Website module of Dolibarr ERP & CRM 22.0.4 and below, the application uses blacklist-based filtering to restrict dangerous PHP functions related to system command execution. An authenticated user with permission to edit PHP content can bypass this filtering, resulting in full remote code execution with the ability to execute arbitrary operating system commands on the server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | <= 22.0.4 |
References
- https://github.com/PhDg1410/CVE/blob/main/CVE-2026-31019/README.mdThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-31019?
How severe is CVE-2026-31019?
How do I fix CVE-2026-31019?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-3101A vulnerability was found in Intelbras TIP 635G 1.12.3.5. Th…8.8
- CVE-2026-31013Dovestones Softwares ADPhonebook <4.0.1.1 has a reflected cr…6.1
- CVE-2026-31014Dovestones Softwares AD Self Update <4.0.0.5 is vulnerable t…6.3
- CVE-2026-31016Cross Site Request Forgery vulnerability in Squidex.io Squid…6.5
- CVE-2026-31017A Server-Side Request Forgery (SSRF) vulnerability exists in…9.1
- CVE-2026-31018In Dolibarr ERP & CRM <= 22.0.4, PHP code detection and edit…8.8
- CVE-2026-3102A vulnerability was determined in exiftool up to 13.49 on ma…8.8
- CVE-2026-31027TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulner…9.8
- CVE-2026-3103A logic error in the remove_password() function in Checkmk G…5.4
- CVE-2026-3104A specially crafted domain can be used to cause a memory lea…7.5
- CVE-2026-31040A vulnerability was identified in stata-mcp prior to v1.13.0…9.8
- CVE-2026-31048An issue in the <code>pickle</code> protocol of Pyro v3.x al…9.8
Are you affected by CVE-2026-31019?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST