CVE-2026-22666
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
A vulnerability in Dolibarr ERP/CRM prior to version 23.0.2 allows authenticated attackers with administrator privileges to achieve remote code execution. The issue is in the dol_eval_standard() function, which fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax.
Risk Assessment
An attacker with administrative access can inject malicious payloads through computed extrafields or other evaluation paths, leading to full server compromise and breach of data confidentiality, integrity, and availability.
Recommendation
Immediately upgrade Dolibarr ERP/CRM to version 23.0.2 or later. Restrict administrator account access and monitor for unusual system activity.
Original NVD description (English source)
Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checks in whitelist mode and does not detect PHP dynamic callable syntax. Attackers with administrator privileges can inject malicious payloads through computed extrafields or other evaluation paths using PHP dynamic callable syntax to bypass validation and achieve arbitrary command execution via eval().