Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: