CVE-2024-37821 describes an arbitrary file upload vulnerability in Dolibarr ERP CRM up to version 19.0.1. The issue occurs in the Upload Template function, where an attacker with low privileges can upload a specially crafted .SQL file. Successful exploitation could result in arbitrary code execution, impacting confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. There is no information about an official patch or vendor advisory at this time.

Exploitation of this vulnerability could allow an attacker with limited privileges to execute arbitrary code on the affected Dolibarr ERP CRM system. This can lead to full compromise of the system, including unauthorized data access, modification, or disruption of service. The high CVSS score indicates a significant risk to affected environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Upload Template function to trusted users only and monitor for suspicious file uploads. Avoid uploading untrusted templates or files. Follow vendor communications closely for updates on patches or official mitigations.