CVE-2026-31019: Dolibarr ERP/CRM RCE Vulnerability

CVE-2026-31019 Overview

CVE-2026-31019 is a command injection vulnerability in the Website module of Dolibarr ERP & CRM version 22.0.4 and below. The application relies on blacklist-based filtering to block dangerous PHP functions related to system command execution. However, an authenticated user with permission to edit PHP content can bypass this filtering mechanism, leading to full remote code execution with the ability to execute arbitrary operating system commands on the server.

Critical Impact

Authenticated attackers can achieve full remote code execution on the server, potentially compromising sensitive business data, customer information, and gaining persistent access to the underlying infrastructure.

Affected Products

• Dolibarr ERP/CRM version 22.0.4 and below
• Dolibarr Website module with PHP editing capabilities enabled
• Systems where authenticated users have permission to edit PHP content

Discovery Timeline

• 2026-04-21 - CVE-2026-31019 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31019

Vulnerability Analysis

This vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command) exists within Dolibarr's Website module, which allows users to create and edit website content including PHP code. The security mechanism designed to prevent code execution relies on a blacklist approach—maintaining a list of known dangerous PHP functions that should be blocked.

The fundamental flaw lies in the blacklist implementation itself. Blacklist-based security is inherently incomplete because it can only block known dangerous patterns while allowing everything else. Attackers can leverage alternative PHP functions, encoding techniques, or language features not covered by the blacklist to execute system commands.

Since this vulnerability requires authentication and specific permissions (ability to edit PHP content), it represents a privilege abuse scenario where a user with elevated access within the application can escalate their privileges to the operating system level.

Root Cause

The root cause is the use of blacklist-based input validation to prevent dangerous PHP function calls. This approach is fundamentally flawed for several reasons:

1. Incomplete Coverage: PHP has numerous ways to execute system commands, and it is practically impossible to enumerate all of them
2. Evasion Techniques: Attackers can use string concatenation, variable functions, or encoding to obfuscate dangerous function calls
3. Language Evolution: New PHP features and functions may introduce additional code execution vectors not covered by existing blacklists

A whitelist approach that only permits known-safe operations would be more secure, or alternatively, preventing direct PHP code editing entirely and using a templating system with restricted capabilities.

Attack Vector

The attack is network-accessible and targets authenticated users who have been granted permission to edit PHP content within the Website module. The attack flow involves:

1. An attacker obtains or already possesses valid credentials with PHP editing permissions
2. The attacker navigates to the Website module's PHP content editor
3. The attacker crafts malicious PHP code that bypasses the blacklist filter
4. Upon execution (either directly or when the website page is accessed), the malicious code runs with the privileges of the web server process
5. The attacker can then execute arbitrary operating system commands, potentially leading to data exfiltration, lateral movement, or persistent backdoor installation

The vulnerability mechanism exploits gaps in the blacklist filtering. For example, while direct calls to functions like system() or exec() may be blocked, alternative approaches such as using PHP's backtick operator, variable function calls, or reflection APIs might not be covered. Technical details and specific bypass methods can be found in the GitHub CVE-2026-31019 Report.

Detection Methods for CVE-2026-31019

Indicators of Compromise

• Unusual PHP files or modifications within the Dolibarr website content directories
• Web server logs showing requests to newly created or modified PHP pages with unexpected output
• Process trees showing web server processes spawning shell commands or unexpected child processes
• Outbound network connections from the web server to unknown or suspicious IP addresses
• Audit logs showing PHP content modifications by users who typically do not perform such actions

Detection Strategies

• Implement file integrity monitoring on Dolibarr's website content directories to detect unauthorized modifications
• Configure web application firewall (WAF) rules to detect common command injection patterns in PHP content submissions
• Monitor web server process activity for unusual child process spawning (e.g., /bin/sh, cmd.exe, or other shell processes)
• Review Dolibarr application logs for PHP content editing activities, especially from users with recently elevated permissions

Monitoring Recommendations

• Enable comprehensive audit logging for all PHP content modifications within Dolibarr
• Deploy endpoint detection and response (EDR) solutions on web servers to detect post-exploitation activity
• Implement network segmentation to limit the blast radius if the web server is compromised
• Set up alerts for any outbound connections from the web server to non-whitelisted destinations

How to Mitigate CVE-2026-31019

Immediate Actions Required

• Review and restrict which users have permission to edit PHP content within the Website module
• Consider temporarily disabling the PHP editing functionality in the Website module until patched
• Audit recent PHP content modifications to identify any potentially malicious code already injected
• Implement additional server-level controls such as disable_functions in php.ini to restrict dangerous functions at the PHP runtime level

Patch Information

Monitor the Dolibarr Official Website for security updates addressing this vulnerability. Upgrade to a patched version as soon as one becomes available. Review the GitHub CVE-2026-31019 Report for additional technical details and potential interim mitigations.

Workarounds

• Disable the Website module entirely if it is not critical to business operations
• Remove PHP editing permissions from all users except those with absolute business necessity, and implement additional review processes for their changes
• Implement server-level PHP hardening by adding dangerous functions to disable_functions in php.ini
• Deploy a web application firewall with rules specifically targeting command injection patterns

# PHP runtime hardening example - add to php.ini
# This provides defense-in-depth but should not be the sole mitigation
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,pcntl_exec,proc_nice,proc_terminate,proc_get_status,proc_close