high8.8
CVE-2024-37821
Dolibarr arbitrary file upload vulnerability
Impact
An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | dolibarr/dolibarr | < 19.0.2 | 19.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Dolibarr | Dolibarr Erp\/Crm | before 19.0.2 |