CVE-2026-37711-nvd.nist.gov-Deferred

An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupda…

Published:

26 May 2026 at 22:00:00

Alert date:

27 May 2026 at 21:06:41

Source:

nvd.nist.gov

Enterprise Applications, Web Technologies

A critical vulnerability (CVE-2026-37711) has been identified in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha that allows remote attackers to execute arbitrary code. The vulnerability is located in the htdocs/core/actions_addupdatedelete.inc.php file. This represents a significant security risk as it enables complete system compromise through remote code execution. The vulnerability affects multiple versions of the popular open-source ERP/CRM system. Organizations using affected versions should prioritize patching to prevent potential exploitation.

Technical details

Mitigation steps:

Affected products:

Dolibarr ERP/CRM