An issue in Dolibarr ERP/CRM v.22.0.0 through v.22.0.4 and v.24.0.0-alpha allows a remote attacker to execute arbitrary code via the htdocs/core/actions_addupda…

Published:

26 mei 2026 om 22:00:00

Alert date:

27 mei 2026 om 20:13:41

Source:

nvd.nist.gov

Enterprise Applications, Web Technologies

A remote code execution vulnerability exists in Dolibarr ERP/CRM versions 22.0.0 through 22.0.4 and 24.0.0-alpha. The vulnerability allows remote attackers to execute arbitrary code via the htdocs/core/actions_addupdatedelete.inc.php file. This affects multiple versions of the popular open-source ERP/CRM software. The vulnerability has been assigned CVE-2026-37711 and appears to be a critical security issue requiring immediate attention from users of affected Dolibarr installations.

Technical details

Mitigation steps:

Affected products:

Dolibarr ERP/CRM