RCE in Dolibarr Erp/crm
CVE-2026-22666
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().
EPSS: 0.155 (96.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dolibarr Erp/crm — versions 0, 6f425521b3e6f9f27eca05228e02093dbaa40dea
- Dolibarr Dolibarr_erp\/crm
Weakness classification (CWE)
Public proof-of-concept exploits
References
- disclosure@vulncheck.com (Exploit, technical-description, Third Party Advisory, exploit)
- disclosure@vulncheck.com (vendor-advisory, Broken Link)
- disclosure@vulncheck.com (Patch, patch)
- disclosure@vulncheck.com (release-notes, Release Notes)
- disclosure@vulncheck.com (VDB Entry, Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2026-22666?
- CVE-2026-22666 is a high-severity vulnerability in Dolibarr Erp/crm, classified under Eval Injection. CVSS score: 7.2/10. Published 2026-04-07.
- How severe is CVE-2026-22666?
- High severity. CVSS v3 base score is 7.2 out of 10.
- Is CVE-2026-22666 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.