CVE-2026-116219: Php Dolibarr Os Command Injection Path Sanitizer Bypasscve-2026-116219-php-dolibarr-os-command-injection-path-sanitizer-bypass
Raw request input read with GETPOST(..., 'none') is sanitized only with dol_sanitizePathName(), a path-name sanitizer that preserves shell metacharacters (&, ;, |, <, >, +). When this value is used as an OS command path/name (persisted in a constant such as SYSTEMTOOLS_MYSQLDUMP and later executed by Utils::dumpDatabase(), or passed directly to exec/system/p
