CVE-2012-10059: Dolibarr Project Erp/crm

Critical severity, CVSS 9.4. EPSS: 4.4% chance of exploitation in the next 30 days.

Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.

Affected products

• Dolibarr Project Erp/crm: up to and including 3.2.0

Published 2025-08-13. Last modified 2026-06-16.