CVE-2020-35136

2020-12-2315:15:16

Google

osv.dev

dolibarr

authenticated

remote code execution

admin dashboard

backup function

filename

zipfilename_template

admin/tools/dolibarr_export.php

software

AI Score

7.1

Confidence

High

EPSS

0.042

Percentile

92.3%

JSON

Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.