What’s Vulnerable › Vulnerabilities

CVE-2026-22666: Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 15.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-07 · updated 2026-10-26
• Weakness: CWE-95

Description

Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().

Affected products

• dolibarr: before 23.0.2 — fixed in 23.0.2

How to fix

Upgrade to a fixed version: dolibarr 23.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/Dolibarr/dolibarr/commit/6f425521b3e6f9f27eca05228e02093dbaa40dea
• https://github.com/Dolibarr/dolibarr/releases/tag/23.0.2
• https://github.com/Dolibarr/dolibarr/security/advisories/GHSA-vmvw-qq8w-wqhg
• https://jivasecurity.com/writeups/dolibarr-remote-code-execution-cve-2026-22666
• https://www.vulncheck.com/advisories/dolibarr-erp-crm-authenticated-rce-via-dol-eval-standard

Get alerted when CVE-2026-22666 or the next vulnerability affects your stack