CVE-2021-33816
Fixed upstream EPSS 4%
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
Products: dolibarr_erp/crm
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | dolibarr/dolibarr | 14.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 16.04 LTS | dolibarr | no fix |