CVE-2026-31019: 
PHP vulnerability analysis and mitigation

CVE-2026-31019 is a PHP function blacklist bypass vulnerability in the Website module of Dolibarr ERP & CRM that enables authenticated users to achieve remote code execution (RCE) and execute arbitrary operating system commands on the server. It affects Dolibarr ERP/CRM versions up to and including 22.0.4. The vulnerability was reported to the vendor on 2026-02-06, acknowledged on 2026-02-12, assigned a CVE on 2026-04-07, and publicly disclosed on 2026-04-21. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory, CVE README).

The root cause is an improper blacklist-based input validation mechanism (CWE-78: OS Command Injection) in the Dolibarr Website module, which attempts to block dangerous PHP functions such as eval, system, and shell_exec using string-based pattern matching. Because the filter relies solely on static string matching, it can be bypassed using obfuscation techniques including encoding, string concatenation, or indirect function invocation — allowing attackers to reconstruct and invoke restricted functions at runtime. Exploitation requires an authenticated user account with permission to edit PHP content in the Website module, after which the attacker can inject and execute arbitrary PHP code that invokes OS-level commands (CVE README, GitHub Advisory).

Successful exploitation grants an attacker full remote code execution on the server, enabling arbitrary OS command execution with the privileges of the web server process. This results in complete compromise of confidentiality (access to sensitive ERP/CRM data including financial records, customer data, and credentials), integrity (modification or deletion of data and system files), and availability (service disruption or malware installation). Attackers could also use the compromised server as a pivot point for lateral movement within the internal network (CVE README, GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.119% (30th percentile), indicating a relatively low near-term exploitation probability. No threat actor attribution has been reported. Detection signatures are available via Nessus (ID: 310628) and Qualys (ID: 5011572) (Feedly).

1. Reconnaissance: Identify Dolibarr ERP/CRM instances running version 22.0.4 or earlier using web fingerprinting tools (e.g., Shodan, Censys) or by inspecting HTTP response headers and page metadata.
2. Obtain credentials: Acquire or compromise an authenticated user account that has permission to edit PHP content within the Dolibarr Website module (e.g., through phishing, credential stuffing, or insider access).
3. Access the Website module: Log in to the Dolibarr admin panel and navigate to the Website module's PHP content editor.
4. Craft obfuscated payload: Construct a PHP payload that bypasses the blacklist filter using obfuscation techniques such as string concatenation (e.g., $f = 'sys'.'tem'; $f('id');), base64 encoding (eval(base64_decode('...'))), or variable function calls to invoke blocked functions like system, shell_exec, or passthru.
5. Inject and execute: Insert the obfuscated PHP payload into the editable PHP content field and save/publish the page, triggering server-side execution of the injected code.
6. Achieve persistent access: Use the RCE to establish a reverse shell, drop a web shell, exfiltrate data, or create a backdoor account for persistent access (CVE README).

• Logs: Dolibarr application logs showing PHP content edits by non-administrative users in the Website module; web server access logs with unusual POST requests to Website module PHP editing endpoints; PHP error logs containing obfuscated function calls or base64-decoded strings.
• File System: Unexpected web shell files (e.g., .php files with encoded payloads) in the Dolibarr web root or Website module directories; modified PHP content files containing obfuscated code patterns such as base64_decode, str_rot13, or concatenated function names.
• Process: Unusual child processes spawned by the web server process (e.g., apache2, php-fpm) such as bash, sh, curl, wget, or nc; unexpected outbound network connections from the web server.
• Network: Outbound connections from the Dolibarr server to unknown external IPs on non-standard ports; DNS lookups for unfamiliar domains initiated by the web server process (CVE README, GitHub Advisory).

Upgrade Dolibarr ERP/CRM to a version above 22.0.4 as the primary remediation; the GitHub Advisory notes no patched version has been formally designated yet, so monitor the official Dolibarr release channel for a fix (GitHub Advisory). As an immediate workaround, restrict access to the Website module's PHP editing functionality to only highly trusted administrators, and audit existing user permissions to remove unnecessary PHP editing rights. Implement server-side controls such as PHP's disable_functions directive in php.ini to block dangerous functions at the interpreter level, independent of application-layer filtering. Enable audit logging for all Website module edits and monitor for obfuscated PHP patterns (CVE README).

The vulnerability was noted on Mastodon by @thehackerwire shortly after disclosure, indicating some community awareness. INCIBE-CERT (Spain's national cybersecurity agency) published an early warning advisory for the vulnerability. No major vendor statements or significant researcher commentary beyond the original disclosure have been identified (Feedly).