CVE-2024-37821

An arbitrary file upload vulnerability in the Upload Template function of Dolibarr ERP CRM up to v19.0.1 allows attackers to execute arbitrary code via uploading a crafted .SQL file.

Published: Jun 18, 2024
Updated: May 4, 2025
CVE: CVE-2024-37821
GHSA: GHSA-p7r8-7w87-8g46
Severity: High
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-94
CWE-434

Affected Software
References

Software	From	Fixed in
dolibarr / dolibarr	-	19.0.2
dolibarr / dolibarr_erp/crm	-	19.0.2

http://dolibarr.com
https://github.com/alexbsec/CVEs/blob/master/2024/CVE-2024-37821.md

Vulnerability Database

CVE-2024-37821