CVE-2024-29477 describes a code injection vulnerability in Dolibarr ERP CRM versions up to and including 19.0.0. The flaw arises from insufficient sanitization of inputs during the installation process, enabling an attacker with adjacent network access to execute arbitrary code. This vulnerability is classified under CWE-94, which involves improper control over code generation. The CVSS 3.1 vector indicates low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level.

Successful exploitation allows an attacker with adjacent network access to execute arbitrary code on the affected system during the installation process. This can lead to full compromise of the system, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, restrict network access to the installation process to trusted administrators only and monitor for suspicious activity during installation.