CVE-2026-22666
Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
| CWE | CWE-95 |
| Vendor | dolibarr |
| Product | dolibarr erp/crm |
| Published | Apr 7, 2026 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for dolibarr dolibarr erp/crm
Be the first to know when new high vulnerabilities affecting dolibarr dolibarr erp/crm are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Dolibarr / Dolibarr ERP/CRM
0 < 23.0.2
References
jivasecurity.com: https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666 github.com: https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg github.com: https://github.com/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea github.com: https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2 vulncheck.com: https://www.vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard
Credits
Jiva (JivaSecurity)