An authenticated administrator in Dolibarr versions up to 22.0.4 can exploit a command injection vulnerability via the MAIN_ODT_AS_PDF configuration setting. This allows arbitrary OS command execution during ODT to PDF conversion. The vulnerability arises because the configuration value is concatenated directly into a shell command without proper sanitization. Successful exploitation can lead to remote code execution with web server privileges, enabling reading sensitive files, modifying code, or full system compromise.