CVE-2021-33816: Dolibarr Erp/crm

Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days.

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.

Affected products

• Dolibarr Dolibarr Erp/crm: version 13.0.2 only

Published 2021-11-10. Last modified 2026-06-17.